dcrat | 3e5ba01dfcea4c4d03d59f11125d0b19f48118333a7035006a442abab3c91270

Analysis

max time kernel
122s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 2.0MB
Sample260424-e37tgaey7z
SHA256 3e5ba01dfcea4c4d03d59f11125d0b19f48118333a7035006a442abab3c91270
MD5 4517db78290f2f9d135f70624676451a
SHA1 ef0cb5b9908baeba1114e9a9c3509bbdf49ea5c8
SHA512 3504430da426c41aa171048a0bcaa2e89de3065d57ca069e6413d7a83918bb61182327baf6965a78f6c131fdc0b9995572d4b0fe60d6a1ffa1538362f9f8d3a3
SSDEEP 49152:+kQTACYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpu:+aC5CbhZcT2lvnDFpFW/twU7+u
TLSH
T1B5A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 10 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		5092	schtasks.exe
		2508	schtasks.exe
		3564	schtasks.exe
		5928	schtasks.exe
		492	schtasks.exe
		2604	schtasks.exe
		1216	schtasks.exe
		2720	schtasks.exe
		3776	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Downloads\\dwm.exe\""	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Downloads\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Downloads\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\winlogon.exe\""	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2964	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2964	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	2964	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	2964	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5928	2964	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	2964	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	492	2964	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2964	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2964	schtasks.exe	79

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Detects executables packed with SmartAssembly 7 IoCs

resource	yara_rule
behavioral2/memory/2780-5234-0x00000000066C0000-0x00000000066D0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2780-5241-0x0000000006D40000-0x0000000006D4A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2780-5248-0x0000000006F80000-0x0000000006F8C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2780-5249-0x0000000006FA0000-0x0000000006FAC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2780-5251-0x00000000085A0000-0x00000000085AC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2780-5253-0x00000000085B0000-0x00000000085BA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2780-5258-0x00000000089D0000-0x00000000089DA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2796	powershell.exe
5472	powershell.exe
3548	powershell.exe
5848	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Executes dropped EXE 4 IoCs

pid	Process
4512	RuntimeBroker.exe
4948	winlogon.exe
2040	dwm.exe
2280	winlogon.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default\\Favorites\\winlogon.exe\""	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default\\Downloads\\dwm.exe\""	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default\\Downloads\\dwm.exe\""	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default\\Favorites\\winlogon.exe\""	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2780-5234-0x00000000066C0000-0x00000000066D0000-memory.dmp	SmartAssembly
behavioral2/memory/2780-5241-0x0000000006D40000-0x0000000006D4A000-memory.dmp	SmartAssembly
behavioral2/memory/2780-5248-0x0000000006F80000-0x0000000006F8C000-memory.dmp	SmartAssembly
behavioral2/memory/2780-5249-0x0000000006FA0000-0x0000000006FAC000-memory.dmp	SmartAssembly
behavioral2/memory/2780-5251-0x00000000085A0000-0x00000000085AC000-memory.dmp	SmartAssembly
behavioral2/memory/2780-5253-0x00000000085B0000-0x00000000085BA000-memory.dmp	SmartAssembly
behavioral2/memory/2780-5258-0x00000000089D0000-0x00000000089DA000-memory.dmp	SmartAssembly

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3564	schtasks.exe
5928	schtasks.exe
492	schtasks.exe
2508	schtasks.exe
2720	schtasks.exe
3776	schtasks.exe
5092	schtasks.exe
2604	schtasks.exe
1216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2796	powershell.exe
2796	powershell.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5848	powershell.exe
5848	powershell.exe
3548	powershell.exe
3548	powershell.exe
5472	powershell.exe
5472	powershell.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3548	powershell.exe
2796	powershell.exe
2796	powershell.exe
5848	powershell.exe
5472	powershell.exe
4948	winlogon.exe
4948	winlogon.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4512	RuntimeBroker.exe
Token: SeDebugPrivilege	4948	winlogon.exe
Token: SeDebugPrivilege	2040	dwm.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	5472	powershell.exe
Token: SeDebugPrivilege	2280	winlogon.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3548	2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	98
PID 2780 wrote to memory of 5472	2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	99
PID 2780 wrote to memory of 2796	2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	100
PID 2780 wrote to memory of 5848	2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	101
PID 2780 wrote to memory of 2280	2780	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	106

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-04-24_4517db78290f2f9d135f70624676451a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Favorites\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5848
- C:\Users\Default\Favorites\winlogon.exe
  "C:\Users\Default\Favorites\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\dwm.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Favorites\winlogon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Favorites\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Favorites\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Recovery\WindowsRE\RuntimeBroker.exe
"C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Users\Default\Favorites\winlogon.exe
"C:\Users\Default\Favorites\winlogon.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4948
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f275e6e-3970-48ae-be19-ee9b95720c42.vbs"
  2⤵
  PID:6932
- - C:\Users\Default\Favorites\winlogon.exe
    C:\Users\Default\Favorites\winlogon.exe
    3⤵
    PID:1620
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b4c4850-9494-4fcb-94b0-2aa0eb803918.vbs"
  2⤵
  PID:5792

C:\Users\Default\Downloads\dwm.exe
"C:\Users\Default\Downloads\dwm.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Recovery\WindowsRE\RuntimeBroker.exe
Size 2.0MB
SHA256 3e5ba01dfcea4c4d03d59f11125d0b19f48118333a7035006a442abab3c91270
MD5 4517db78290f2f9d135f70624676451a
SHA1 ef0cb5b9908baeba1114e9a9c3509bbdf49ea5c8
SHA512 3504430da426c41aa171048a0bcaa2e89de3065d57ca069e6413d7a83918bb61182327baf6965a78f6c131fdc0b9995572d4b0fe60d6a1ffa1538362f9f8d3a3
SSDEEP 49152:+kQTACYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpu:+aC5CbhZcT2lvnDFpFW/twU7+u
TLSH
T1B5A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

winlogon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\winlogon.exe.log
Size 942B
SHA256 54ed88aec6eae20f57d6e9ad59b96959b326557d30b20609c021194706240493
MD5 49c71e2e40f98f6ac4eeb0cac2577ac0
SHA1 fbc92dd6f00413b6b3108ba2fdcc31633e983300
SHA512 185598c417b36f1d069b4d34e4f01a844989a20d9fd8d1420cc5577df797f6a2338e83dbf6d949bc71007029ee9d806d0903d606672a04a05103dc8f8114c07b
TLSH
T17B1159702231B1D94C533F930C5D66841AFF0755B6A8EE2C7599325EDC2A0176F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 22be84167f302633260498efb66d651687a23cf18996500bf9d6d02522faf037
MD5 9286957914431c5d186c1e5c4c8a0113
SHA1 bf9685e095146fd7abfa860a1fe32ff1ff6c845c
SHA512 fc2376644c6450e4c6ee317d4a1e29102ad246aa2313a52a9c7ef823e19f57076ed587cca16adfe6f917e6710a4763fc894faa2b89cbaba7cd22395a490441c5
SSDEEP 384:yL3HhsSS1UESLgy6FRHEME2HnnNzjs2xtgmNrm25Ph9Joy0iFdL:8ySSCEi6RPEGNzj7xtgurmuh9Joy00
TLSH
T12092D4AE711F22C3C89553B8E10B050FE8F2DE8D431913D9BB2E9E7B89AC65E513D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 5eb3491be2a26e53cbb08a57924d65825234fae461f18b7edde89699c847160a
MD5 9f804843753768a8c00c5a223433a810
SHA1 56d6eb931edacd576ccbc73711e843f28abd0f6d
SHA512 c92f1b80bb88544e588a5ef7fd3571f8630abe939563a630c99217ce0cce00097496b3b129468e08cb1c1abab77956f3846d1c436113e4c1b2d3a3d5faacd59f
SSDEEP 384:zTHhRSS1dshpBOFRHEMEqHnnNzjs2xtg+Nr6c5909JQX0iFR/:DSSHshmRPE6Nzj7xtgGr6O09JQX0s
TLSH
T1F992B4AE611F22C3C89553B8E10B050FE8F2DE8D431912D9BB2D9F7B89AC65E813D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 125c50af9f2b62e41d8be54a6ac20cea3c93c8fc51b4d56f05cd6b8d434f4a6e
MD5 d82eccad5ca2a0d2fdbdfa6414708df5
SHA1 d09e0183cf4ae05b01e16eb228e3c343d2c4fc41
SHA512 17779979a062f7060b62d4cbf791d70e72dc505ae9f5f76075209cafbebfa3afa2e4ccd5afbe6be95fba1aac2fc6fff4bec2a1ef40a5824b6efbfc4cef5df4e5
SSDEEP 384:hTHhY1SS1C7W7UFRHEME2Hn0kNzjs2xtgiNry2L9I9JEX0iF1X:MSS07WARPEGZzj7xtgyryeI9JEX0Q
TLSH
T10F92D6AE711F22C3C89553B8D10B050FE8F2DE8D431912D9BB2E9F7B89ACA5E513D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f275e6e-3970-48ae-be19-ee9b95720c42.vbs

Path C:\Users\Admin\AppData\Local\Temp\2f275e6e-3970-48ae-be19-ee9b95720c42.vbs
Size 715B
SHA256 49e38fbd42c9c29925481f44a0ddd0cb12f9161b335a580942cc59941ed103f9
MD5 e2243b0434f7322b54f5b50b92f500ba
SHA1 11fff11cc57eddfc66f6acc509f4eb1e83e96122
SHA512 36ab0935d93d80b2418af10239adc9d71abf5ad629f0e776abd3d5424fb2ec37d2db6bfbadf381adf349e62707002f84d9f1424b3190787e373bc4ba68037d27
TLSH
T10701C006BE0BE67024A1334091F655BF5DD8801C2176BD5BB950E46C2706D2404EC4ED
MD5 SHA1 SHA512 TLSH

Submit Download

4b4c4850-9494-4fcb-94b0-2aa0eb803918.vbs

Path C:\Users\Admin\AppData\Local\Temp\4b4c4850-9494-4fcb-94b0-2aa0eb803918.vbs
Size 491B
SHA256 954564bb14a4da77fe811ac1bc0d9c156cf25c67b9ecbd822c7e4200fb057032
MD5 a73037a2fd011fff283181ab351f40b1
SHA1 b7b442cf91dc0b2f9b448e97dce8dba5a83d3fe7
SHA512 a03498315737d08ac7cb43a1582f827560268063cd2689b4bee20fc27b8ab1e362bc2c9d7838671da59b09008765681f731942b1727e45c3b26355e8800da2f9
TLSH
T153F0D40EBF05C334C801134303FA998F49BC840D3678E59D5608D8DD314253809EE1CF
MD5 SHA1 SHA512 TLSH

Submit Download

RCX53F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX53F8.tmp
Size 2.0MB
SHA256 151ed1a44484510aaea443021d98917720229126df4d51094f4aa14e29ec47e9
MD5 80ad3909787d28b385bbb5ff554cb371
SHA1 b1b425843434e571ac88759823836fb79c9a13b9
SHA512 9e9c8d6dbdb3a8b063348a51d2c68334fc954383822c468dbeb8463e51ed8a52aa572185d739d9e7bd44470dad54e0d0dc486f48b3c37621054b576e98c06a6f
SSDEEP 1536:8xxKY+T6KW5CvEyXWvE344wAL5LO8XvdPTwZI3sq5gnToIfnIOlIOjcTp5X7XX:8nDKW1LgppLRHMY0TBfJvjcTp5X7XX
TLSH
T1C9A56B2175C1C1B3C4B7113044E6CB799A7A3071076A96D7B6DD2BBA6E213E1A3362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_upeo435u.e4l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_upeo435u.e4l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2780-26-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-5234-0x00000000066C0000-0x00000000066D0000-memory.dmp

Download

memory/2780-56-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-60-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-89-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-72-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-70-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-68-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-64-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-62-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-58-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-66-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-54-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-52-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-50-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-5232-0x0000000004D10000-0x0000000004D60000-memory.dmp

Download

memory/2780-46-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-44-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-40-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-38-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-36-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-34-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-30-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-28-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-0-0x0000000005300000-0x0000000005310000-memory.dmp

Download

memory/2780-20-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-18-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-16-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-12-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-8-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-6-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-94-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-92-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-91-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-86-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-84-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-82-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-80-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-78-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-76-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-74-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-108-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-118-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-130-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-128-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-126-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-124-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-122-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-120-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-114-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-112-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-106-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-104-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-102-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-100-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-98-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-96-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-116-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-110-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-1640-0x0000000005300000-0x0000000005310000-memory.dmp

Download

memory/2780-1854-0x0000000005300000-0x0000000005310000-memory.dmp

Download

memory/2780-2081-0x0000000005300000-0x0000000005310000-memory.dmp

Download

memory/2780-42-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-5230-0x0000000005300000-0x0000000005310000-memory.dmp

Download

memory/2780-48-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-5233-0x0000000004D70000-0x0000000004D78000-memory.dmp

Download

memory/2780-5231-0x0000000004CE0000-0x0000000004CFC000-memory.dmp

Download

memory/2780-5235-0x00000000066D0000-0x00000000066E6000-memory.dmp

Download

memory/2780-5236-0x0000000006CC0000-0x0000000006CC8000-memory.dmp

Download

memory/2780-5237-0x0000000006E10000-0x0000000006E22000-memory.dmp

Download

memory/2780-5238-0x0000000006CD0000-0x0000000006CD8000-memory.dmp

Download

memory/2780-5239-0x0000000006D50000-0x0000000006D60000-memory.dmp

Download

memory/2780-5240-0x0000000007FC0000-0x0000000008052000-memory.dmp

Download

memory/2780-5241-0x0000000006D40000-0x0000000006D4A000-memory.dmp

Download

memory/2780-5242-0x0000000006D60000-0x0000000006D68000-memory.dmp

Download

memory/2780-5243-0x0000000006DD0000-0x0000000006DDC000-memory.dmp

Download

memory/2780-5244-0x0000000006D90000-0x0000000006D98000-memory.dmp

Download

memory/2780-5246-0x0000000006DB0000-0x0000000006DC2000-memory.dmp

Download

memory/2780-5247-0x0000000008060000-0x000000000858C000-memory.dmp

Download

memory/2780-5248-0x0000000006F80000-0x0000000006F8C000-memory.dmp

Download

memory/2780-5250-0x0000000006FB0000-0x0000000006FBC000-memory.dmp

Download

memory/2780-5249-0x0000000006FA0000-0x0000000006FAC000-memory.dmp

Download

memory/2780-5251-0x00000000085A0000-0x00000000085AC000-memory.dmp

Download

memory/2780-5253-0x00000000085B0000-0x00000000085BA000-memory.dmp

Download

memory/2780-5252-0x0000000008950000-0x0000000008958000-memory.dmp

Download

memory/2780-5257-0x00000000089C0000-0x00000000089C8000-memory.dmp

Download

memory/2780-5259-0x00000000089E0000-0x00000000089EC000-memory.dmp

Download

memory/2780-5256-0x00000000089B0000-0x00000000089B8000-memory.dmp

Download

memory/2780-5258-0x00000000089D0000-0x00000000089DA000-memory.dmp

Download

memory/2780-5255-0x0000000005300000-0x0000000005310000-memory.dmp

Download

memory/2780-5254-0x0000000008960000-0x000000000896E000-memory.dmp

Download

memory/2780-5262-0x0000000008A00000-0x0000000008A66000-memory.dmp

Download

memory/2780-32-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-22-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-6841-0x0000000005300000-0x0000000005310000-memory.dmp

Download

memory/2780-1-0x00000000055D0000-0x0000000005888000-memory.dmp

Download

memory/2780-7289-0x0000000005300000-0x0000000005310000-memory.dmp

Download

memory/2780-2-0x0000000005300000-0x0000000005310000-memory.dmp

Download

memory/2780-3-0x0000000005890000-0x0000000005E36000-memory.dmp

Download

memory/2780-24-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-4-0x0000000005310000-0x00000000055C6000-memory.dmp

Download

memory/2780-5-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-10-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2780-14-0x0000000005310000-0x00000000055C1000-memory.dmp

Download

memory/2796-26311-0x0000000071600000-0x000000007164C000-memory.dmp

Download

memory/2796-7210-0x00000000053A0000-0x00000000053D6000-memory.dmp

Download

memory/2796-10482-0x0000000006290000-0x00000000062F6000-memory.dmp

Download

memory/2796-10481-0x00000000061F0000-0x0000000006212000-memory.dmp

Download

memory/2796-10712-0x0000000006370000-0x00000000066C7000-memory.dmp

Download

memory/3548-26325-0x00000000074C0000-0x00000000074CE000-memory.dmp

Download

memory/3548-26334-0x00000000075D0000-0x00000000075EA000-memory.dmp

Download

memory/3548-26195-0x0000000007510000-0x00000000075A6000-memory.dmp

Download

memory/3548-26310-0x0000000007490000-0x00000000074A1000-memory.dmp

Download

memory/3548-25160-0x0000000006430000-0x0000000006464000-memory.dmp

Download

memory/3548-25621-0x0000000007260000-0x000000000727A000-memory.dmp

Download

memory/3548-26347-0x00000000075C0000-0x00000000075C8000-memory.dmp

Download

memory/3548-25161-0x0000000071600000-0x000000007164C000-memory.dmp

Download

memory/3548-26333-0x00000000074D0000-0x00000000074E5000-memory.dmp

Download

memory/3548-25905-0x00000000072E0000-0x00000000072EA000-memory.dmp

Download

memory/3548-25194-0x0000000006E40000-0x0000000006EE4000-memory.dmp

Download

memory/3548-19962-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

Download

memory/3548-20235-0x0000000006340000-0x000000000638C000-memory.dmp

Download

memory/3548-25614-0x00000000078A0000-0x0000000007F1A000-memory.dmp

Download

memory/3548-25193-0x00000000061F0000-0x000000000620E000-memory.dmp

Download

memory/5472-26326-0x0000000071600000-0x000000007164C000-memory.dmp

Download

memory/5848-26318-0x0000000071600000-0x000000007164C000-memory.dmp

Download

memory/5848-7555-0x0000000005CC0000-0x00000000062EA000-memory.dmp

Download