dcrat | 4d1f2cd4d7b2241abd3d416f66d5503f0c2a84a1359ab8d00460fb015831ea82

Analysis

max time kernel
28s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 2.0MB
Sample260522-3jc2ragt5m
SHA256 4d1f2cd4d7b2241abd3d416f66d5503f0c2a84a1359ab8d00460fb015831ea82
MD5 a71fd38d81b6ef88062e09bca33e3c49
SHA1 38d4d896f4a290482e52d524f6124b4836a2e277
SHA512 56953ccd5e3c0378dace27403d159f50b55c737a1f817ae24df8725755db509b63c7380998313936f0d9f5e3c23874b5b23fccc583515380b21bfa4143afad6d
SSDEEP 49152:OkQTAuYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpY:Oau5CbhZcT2lvnDFpFW/twU7+Y
TLSH
T196A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 50 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		6712	schtasks.exe
		7476	schtasks.exe
		6980	schtasks.exe
		6128	schtasks.exe
		5080	schtasks.exe
		2752	schtasks.exe
		704	schtasks.exe
		4752	schtasks.exe
		3756	schtasks.exe
		4604	schtasks.exe
		2216	schtasks.exe
		4044	schtasks.exe
		7980	schtasks.exe
		3592	schtasks.exe
		344	schtasks.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\6ccacd8608530f		2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		4488	schtasks.exe
		3492	schtasks.exe
		6768	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		5024	schtasks.exe
		4320	schtasks.exe
		2924	schtasks.exe
		5952	schtasks.exe
		1832	schtasks.exe
		4904	schtasks.exe
		1096	schtasks.exe
		3164	schtasks.exe
		1628	schtasks.exe
		5524	schtasks.exe
		5816	schtasks.exe
		6708	schtasks.exe
		6360	schtasks.exe
		2820	schtasks.exe
		9060	schtasks.exe
		5932	schtasks.exe
		3052	schtasks.exe
		1140	schtasks.exe
		5228	schtasks.exe
		4336	schtasks.exe
		2240	schtasks.exe
		1536	schtasks.exe
		9064	schtasks.exe
		580	schtasks.exe
		4868	schtasks.exe
		5956	schtasks.exe
		3260	schtasks.exe
		1816	schtasks.exe
		5588	schtasks.exe
		2560	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\140.0.7339.81\\Idle.exe\""	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\140.0.7339.81\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5932	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6128	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5956	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5228	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5524	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5588	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5952	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5816	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6708	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6712	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6360	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7476	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9060	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7980	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9064	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6768	5160	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6980	5160	schtasks.exe	80

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 7 IoCs

resource	yara_rule
behavioral2/memory/1988-5231-0x0000000006270000-0x0000000006280000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1988-5238-0x0000000006990000-0x000000000699A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1988-5245-0x0000000006BD0000-0x0000000006BDC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1988-5246-0x0000000006BF0000-0x0000000006BFC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1988-5248-0x00000000081F0000-0x00000000081FC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1988-5250-0x00000000085A0000-0x00000000085AA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/1988-5255-0x0000000008620000-0x000000000862A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Google\\Chrome\\Application\\140.0.7339.81\\Idle.exe\""	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Google\\Chrome\\Application\\140.0.7339.81\\Idle.exe\""	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/1988-5231-0x0000000006270000-0x0000000006280000-memory.dmp	SmartAssembly
behavioral2/memory/1988-5238-0x0000000006990000-0x000000000699A000-memory.dmp	SmartAssembly
behavioral2/memory/1988-5245-0x0000000006BD0000-0x0000000006BDC000-memory.dmp	SmartAssembly
behavioral2/memory/1988-5246-0x0000000006BF0000-0x0000000006BFC000-memory.dmp	SmartAssembly
behavioral2/memory/1988-5248-0x00000000081F0000-0x00000000081FC000-memory.dmp	SmartAssembly
behavioral2/memory/1988-5250-0x00000000085A0000-0x00000000085AA000-memory.dmp	SmartAssembly
behavioral2/memory/1988-5255-0x0000000008620000-0x000000000862A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Idle.exe	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Idle.exe	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\6ccacd8608530f	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3052	schtasks.exe
2240	schtasks.exe
4604	schtasks.exe
6708	schtasks.exe
1536	schtasks.exe
6980	schtasks.exe
4752	schtasks.exe
5228	schtasks.exe
1096	schtasks.exe
1628	schtasks.exe
4488	schtasks.exe
5816	schtasks.exe
6768	schtasks.exe
580	schtasks.exe
5956	schtasks.exe
2560	schtasks.exe
3756	schtasks.exe
6128	schtasks.exe
344	schtasks.exe
5080	schtasks.exe
2216	schtasks.exe
5024	schtasks.exe
1816	schtasks.exe
704	schtasks.exe
2924	schtasks.exe
3164	schtasks.exe
4336	schtasks.exe
4904	schtasks.exe
3492	schtasks.exe
5932	schtasks.exe
1832	schtasks.exe
1140	schtasks.exe
6712	schtasks.exe
7980	schtasks.exe
9064	schtasks.exe
3260	schtasks.exe
4320	schtasks.exe
5524	schtasks.exe
3592	schtasks.exe
4044	schtasks.exe
6360	schtasks.exe
2820	schtasks.exe
2752	schtasks.exe
4868	schtasks.exe
5588	schtasks.exe
5952	schtasks.exe
7476	schtasks.exe
9060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1988	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
1988	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
1988	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
1988	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
1988	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_a71fd38d81b6ef88062e09bca33e3c49_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\140.0.7339.81\Idle.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\140.0.7339.81\Idle.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\140.0.7339.81\Idle.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Start Menu\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Start Menu\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\ja-JP\System.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ja-JP\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\ja-JP\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\SppExtComObj.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\Cursors\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Cursors\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Cursors\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe
"C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe"
1⤵
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5952

C:\Recovery\WindowsRE\OfficeClickToRun.exe
"C:\Recovery\WindowsRE\OfficeClickToRun.exe"
1⤵
PID:4976

C:\Program Files (x86)\Windows Sidebar\Gadgets\csrss.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\csrss.exe"
1⤵
PID:4712

C:\Recovery\WindowsRE\dllhost.exe
"C:\Recovery\WindowsRE\dllhost.exe"
1⤵
PID:3220

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
1⤵
PID:2260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\Idle.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\Idle.exe"
1⤵
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\uninstall\services.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\uninstall\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Users\Default\Start Menu\RuntimeBroker.exe
"C:\Users\Default\Start Menu\RuntimeBroker.exe"
1⤵
PID:5936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Application Data\services.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:9060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Program Files\Windows Media Player\SppExtComObj.exe
"C:\Program Files\Windows Media Player\SppExtComObj.exe"
1⤵
PID:8660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\en-US\wininit.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:9064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6980

C:\Windows\ja-JP\System.exe
"C:\Windows\ja-JP\System.exe"
1⤵
PID:6760

C:\Recovery\WindowsRE\sihost.exe
"C:\Recovery\WindowsRE\sihost.exe"
1⤵
PID:9012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OfficeClickToRun.exe

Path C:\Recovery\WindowsRE\OfficeClickToRun.exe
Size 2.0MB
SHA256 4d1f2cd4d7b2241abd3d416f66d5503f0c2a84a1359ab8d00460fb015831ea82
MD5 a71fd38d81b6ef88062e09bca33e3c49
SHA1 38d4d896f4a290482e52d524f6124b4836a2e277
SHA512 56953ccd5e3c0378dace27403d159f50b55c737a1f817ae24df8725755db509b63c7380998313936f0d9f5e3c23874b5b23fccc583515380b21bfa4143afad6d
SSDEEP 49152:OkQTAuYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpY:Oau5CbhZcT2lvnDFpFW/twU7+Y
TLSH
T196A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.exe

Path C:\Windows\ja-JP\System.exe
Size 896KB
SHA256 5ee88e78b460cd6bd28022b64b3dd9d2d290d4932e40f22ca144e23cce405af6
MD5 4a335735f983db0db4ab1abf0cffc820
SHA1 2c33f89f4d9ee981c8ac7591c797b22d311e8355
SHA512 4c31154c74dcead915351e538511d52a7e68ab1800c97083aec815b7284757a1323d84f3c1904e520cabb138d94b0619d947f09f65f2e6849257ec37cad5b287
SSDEEP 24576:Ok70TrcR8BSnLW2CRBKViu99LK1Rad6yZcT29fhdu+:OkQTAuYS/v6h3+1uhZcT2Nnn
TLSH
T14A15222870C0C0B6D56A503648C5CE759E36B472437E85DBBBDD63B5AF203E1A3396CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1988-0-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/1988-1-0x00000000054B0000-0x0000000005768000-memory.dmp

Download

memory/1988-2-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/1988-3-0x0000000005770000-0x0000000005D16000-memory.dmp

Download

memory/1988-4-0x00000000051F0000-0x00000000054A6000-memory.dmp

Download

memory/1988-6-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-10-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-20-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-16-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-30-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-56-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-62-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-64-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-60-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-58-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-50-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-48-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-46-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-45-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-40-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-54-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-52-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-42-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-36-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-34-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-32-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-28-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-26-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-24-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-22-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-38-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-18-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-14-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-8-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-12-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-5-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-68-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-98-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-108-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-126-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-122-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-120-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-118-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-117-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-112-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-110-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-130-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-128-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-125-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-114-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-100-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-106-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-104-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-102-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-92-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-90-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-88-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-82-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-80-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-78-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-76-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-96-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-94-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-66-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-86-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-84-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-74-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-72-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-70-0x00000000051F0000-0x00000000054A1000-memory.dmp

Download

memory/1988-1998-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/1988-2298-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/1988-5227-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/1988-5228-0x0000000004D10000-0x0000000004D2C000-memory.dmp

Download

memory/1988-5229-0x0000000004D40000-0x0000000004D90000-memory.dmp

Download

memory/1988-5231-0x0000000006270000-0x0000000006280000-memory.dmp

Download

memory/1988-5230-0x0000000004DA0000-0x0000000004DA8000-memory.dmp

Download

memory/1988-5232-0x0000000006590000-0x00000000065A6000-memory.dmp

Download

memory/1988-5233-0x0000000006910000-0x0000000006918000-memory.dmp

Download

memory/1988-5234-0x0000000006A60000-0x0000000006A72000-memory.dmp

Download

memory/1988-5235-0x0000000006920000-0x0000000006928000-memory.dmp

Download

memory/1988-5236-0x0000000006A00000-0x0000000006A10000-memory.dmp

Download

memory/1988-5237-0x0000000007C10000-0x0000000007CA2000-memory.dmp

Download

memory/1988-5238-0x0000000006990000-0x000000000699A000-memory.dmp

Download

memory/1988-5239-0x00000000069A0000-0x00000000069A8000-memory.dmp

Download

memory/1988-5240-0x00000000069C0000-0x00000000069CC000-memory.dmp

Download

memory/1988-5241-0x00000000069D0000-0x00000000069D8000-memory.dmp

Download

memory/1988-5243-0x00000000069E0000-0x00000000069F2000-memory.dmp

Download

memory/1988-5244-0x0000000007CB0000-0x00000000081DC000-memory.dmp

Download

memory/1988-5245-0x0000000006BD0000-0x0000000006BDC000-memory.dmp

Download

memory/1988-5246-0x0000000006BF0000-0x0000000006BFC000-memory.dmp

Download

memory/1988-5247-0x0000000006C00000-0x0000000006C0C000-memory.dmp

Download

memory/1988-5248-0x00000000081F0000-0x00000000081FC000-memory.dmp

Download

memory/1988-5249-0x0000000008200000-0x0000000008208000-memory.dmp

Download

memory/1988-5250-0x00000000085A0000-0x00000000085AA000-memory.dmp

Download

memory/1988-5253-0x0000000008610000-0x0000000008618000-memory.dmp

Download

memory/1988-5255-0x0000000008620000-0x000000000862A000-memory.dmp

Download

memory/1988-5256-0x0000000008630000-0x000000000863C000-memory.dmp

Download

memory/1988-5252-0x0000000008600000-0x0000000008608000-memory.dmp

Download

memory/1988-5254-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/1988-5251-0x00000000085B0000-0x00000000085BE000-memory.dmp

Download

memory/1988-5259-0x0000000008650000-0x00000000086B6000-memory.dmp

Download

memory/1988-9410-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download

memory/1988-10238-0x0000000002CF0000-0x0000000002D00000-memory.dmp

Download