dcrat | e72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900

Analysis

max time kernel
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
Size 1.7MB
Sample260606-bbertsht9p
SHA256 e72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900
MD5 104415cad4b46061d73f4b1958bcad27
SHA1 7ccf759482adff6dd0145143f5c9882af70b6aa5
SHA512 d7fb22e9f8c8977b742938f52f0178bd5f323e5fee5a89c336cb9875d0fa14f5cd24159cb2498054f57f9d80ea8b0ccb802e5527d185bbf3f50b61c05b8f775a
SSDEEP 49152:8kQTArIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scE:8ahuRD9JdOR4m+lmY/4rx8cE
TLSH
T1148523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 58 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2828	schtasks.exe
		4988	schtasks.exe
		2320	schtasks.exe
		2732	schtasks.exe
		4228	schtasks.exe
		4780	schtasks.exe
		3988	schtasks.exe
		5652	schtasks.exe
		1860	schtasks.exe
		4488	schtasks.exe
		3880	schtasks.exe
		4956	schtasks.exe
		1364	schtasks.exe
		4780	schtasks.exe
		1688	schtasks.exe
		4308	schtasks.exe
		5780	schtasks.exe
		2492	schtasks.exe
		3104	schtasks.exe
		416	schtasks.exe
		4860	schtasks.exe
		3048	schtasks.exe
		1764	schtasks.exe
		684	schtasks.exe
		1856	schtasks.exe
		1096	schtasks.exe
		1664	schtasks.exe
		788	schtasks.exe
		4568	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
		3652	schtasks.exe
		2692	schtasks.exe
		4044	schtasks.exe
		2228	schtasks.exe
		3340	schtasks.exe
		4636	schtasks.exe
		2088	schtasks.exe
		5008	schtasks.exe
		3748	schtasks.exe
		2460	schtasks.exe
		1924	schtasks.exe
		5288	schtasks.exe
		4456	schtasks.exe
		2396	schtasks.exe
		2924	schtasks.exe
		3192	schtasks.exe
		864	schtasks.exe
		5012	schtasks.exe
		5044	schtasks.exe
		1060	schtasks.exe
		3416	schtasks.exe
		4884	schtasks.exe
		224	schtasks.exe
		5000	schtasks.exe
		4124	schtasks.exe
		3156	schtasks.exe
		4968	schtasks.exe
		4692	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\smss.exe\""	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	416	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5780	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5652	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	2220	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5288	2220	schtasks.exe	80

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
12392	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\smss.exe\""	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\smss.exe\""	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/1548-5232-0x0000000006290000-0x00000000062A0000-memory.dmp	SmartAssembly
behavioral2/memory/1548-5236-0x0000000006800000-0x000000000680A000-memory.dmp	SmartAssembly
behavioral2/memory/1548-5241-0x0000000006E10000-0x0000000006E1C000-memory.dmp	SmartAssembly
behavioral2/memory/1548-5244-0x00000000071F0000-0x00000000071FC000-memory.dmp	SmartAssembly
behavioral2/memory/1548-5242-0x0000000006E40000-0x0000000006E4A000-memory.dmp	SmartAssembly

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
684	schtasks.exe
3048	schtasks.exe
416	schtasks.exe
3652	schtasks.exe
4780	schtasks.exe
4228	schtasks.exe
1664	schtasks.exe
3192	schtasks.exe
1364	schtasks.exe
5288	schtasks.exe
1856	schtasks.exe
3748	schtasks.exe
2396	schtasks.exe
3104	schtasks.exe
4956	schtasks.exe
4568	schtasks.exe
4860	schtasks.exe
3340	schtasks.exe
4692	schtasks.exe
4780	schtasks.exe
4044	schtasks.exe
4636	schtasks.exe
4308	schtasks.exe
2828	schtasks.exe
5012	schtasks.exe
4988	schtasks.exe
3988	schtasks.exe
1096	schtasks.exe
2732	schtasks.exe
2924	schtasks.exe
5000	schtasks.exe
864	schtasks.exe
5044	schtasks.exe
2692	schtasks.exe
2228	schtasks.exe
4456	schtasks.exe
788	schtasks.exe
4124	schtasks.exe
1688	schtasks.exe
4488	schtasks.exe
3416	schtasks.exe
3156	schtasks.exe
1060	schtasks.exe
2460	schtasks.exe
2492	schtasks.exe
5008	schtasks.exe
4968	schtasks.exe
5652	schtasks.exe
1860	schtasks.exe
1764	schtasks.exe
224	schtasks.exe
2320	schtasks.exe
1924	schtasks.exe
3880	schtasks.exe
5780	schtasks.exe
4884	schtasks.exe
2088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1548	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
1548	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
1548	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe
"C:\Users\Admin\AppData\Local\Temp\xe72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:12392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Public\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Public\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Public\lsass.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\Setup\winlogon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Adobe\Setup\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Start Menu\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Start Menu\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\SppExtComObj.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\SendTo\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\SendTo\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\services.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\taskhostw.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\explorer.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\SysWOW64\FxsTmp\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SysWOW64\FxsTmp\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\SysWOW64\FxsTmp\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Videos\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Videos\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\Media\Cityscape\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Media\Cityscape\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Program Files (x86)\Windows Photo Viewer\es-ES\explorer.exe
"C:\Program Files (x86)\Windows Photo Viewer\es-ES\explorer.exe"
1⤵
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\Media\Cityscape\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Users\Default User\smss.exe
"C:\Users\Default User\smss.exe"
1⤵
PID:4568

C:\Users\All Users\Adobe\Setup\winlogon.exe
"C:\Users\All Users\Adobe\Setup\winlogon.exe"
1⤵
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Users\Public\smss.exe
"C:\Users\Public\smss.exe"
1⤵
PID:3064

C:\Users\Public\lsass.exe
"C:\Users\Public\lsass.exe"
1⤵
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\winlogon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5652

C:\Users\Admin\taskhostw.exe
"C:\Users\Admin\taskhostw.exe"
1⤵
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5288

C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe"
1⤵
PID:6280

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\SppExtComObj.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\SppExtComObj.exe"
1⤵
PID:5808

C:\Program Files\Windows Photo Viewer\services.exe
"C:\Program Files\Windows Photo Viewer\services.exe"
1⤵
PID:7888

C:\Users\All Users\Start Menu\dllhost.exe
"C:\Users\All Users\Start Menu\dllhost.exe"
1⤵
PID:6480

C:\Users\Admin\SendTo\dllhost.exe
"C:\Users\Admin\SendTo\dllhost.exe"
1⤵
PID:9072

C:\Recovery\WindowsRE\dllhost.exe
"C:\Recovery\WindowsRE\dllhost.exe"
1⤵
PID:8488

C:\Recovery\WindowsRE\WUDFHost.exe
"C:\Recovery\WindowsRE\WUDFHost.exe"
1⤵
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\dllhost.exe
Size 1.7MB
SHA256 e72535001f592a5c74ca75368731dc47d8f4e9485da3a9c641e0f1a73027a900
MD5 104415cad4b46061d73f4b1958bcad27
SHA1 7ccf759482adff6dd0145143f5c9882af70b6aa5
SHA512 d7fb22e9f8c8977b742938f52f0178bd5f323e5fee5a89c336cb9875d0fa14f5cd24159cb2498054f57f9d80ea8b0ccb802e5527d185bbf3f50b61c05b8f775a
SSDEEP 49152:8kQTArIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scE:8ahuRD9JdOR4m+lmY/4rx8cE
TLSH
T1148523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC230.tmp

Path C:\Windows\Media\Cityscape\RCXC230.tmp
Size 1.7MB
SHA256 5513351ef4aa365090a1a2535adb1a6c98e4b50d79713ddcf12e315c0776a363
MD5 baa9d6ec7cff874415aee43bb07397e0
SHA1 6144a89913a5d483c3729c0f06605c0b5aabf07f
SHA512 3f4f7bc9de4001c311117f25ea3cb9f42489f47035a371ace900a410bcf50df1adebcc0d2fc50c47337173d6216e5e5adb4041c3b74680f41712f58339566757
SSDEEP 49152:ckQTAzIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc8:caJuRD9JdOR4m+lmY/4rx8c8
TLSH
T1D78523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-0-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/1548-1-0x0000000005510000-0x000000000578C000-memory.dmp

Download

memory/1548-2-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/1548-3-0x0000000005790000-0x0000000005D36000-memory.dmp

Download

memory/1548-4-0x0000000005280000-0x00000000054FA000-memory.dmp

Download

memory/1548-14-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-18-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-22-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-24-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-32-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-64-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-84-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-90-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-98-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-96-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-94-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-92-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-88-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-86-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-80-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-78-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-76-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-74-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-72-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-70-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-83-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-68-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-66-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-62-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-60-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-58-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-56-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-54-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-52-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-50-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-48-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-46-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-44-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-42-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-40-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-38-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-36-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-34-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-30-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-28-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-27-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-20-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-16-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-12-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-10-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-8-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-6-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-5-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-102-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-110-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-130-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-128-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-126-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-124-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-122-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-120-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-118-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-115-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-113-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-108-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-106-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-104-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-100-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-117-0x0000000005280000-0x00000000054F4000-memory.dmp

Download

memory/1548-1403-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/1548-1714-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/1548-2045-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/1548-5228-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/1548-5229-0x0000000002BC0000-0x0000000002BDC000-memory.dmp

Download

memory/1548-5230-0x0000000002BF0000-0x0000000002C40000-memory.dmp

Download

memory/1548-5232-0x0000000006290000-0x00000000062A0000-memory.dmp

Download

memory/1548-5231-0x0000000002C50000-0x0000000002C58000-memory.dmp

Download

memory/1548-5233-0x00000000067C0000-0x00000000067D6000-memory.dmp

Download

memory/1548-5234-0x00000000065A0000-0x00000000065A8000-memory.dmp

Download

memory/1548-5235-0x00000000067E0000-0x00000000067F0000-memory.dmp

Download

memory/1548-5236-0x0000000006800000-0x000000000680A000-memory.dmp

Download

memory/1548-5237-0x0000000006830000-0x000000000683C000-memory.dmp

Download

memory/1548-5238-0x0000000006840000-0x0000000006852000-memory.dmp

Download

memory/1548-5239-0x0000000006870000-0x0000000006D9C000-memory.dmp

Download

memory/1548-5240-0x0000000006E00000-0x0000000006E0C000-memory.dmp

Download

memory/1548-5241-0x0000000006E10000-0x0000000006E1C000-memory.dmp

Download

memory/1548-5244-0x00000000071F0000-0x00000000071FC000-memory.dmp

Download

memory/1548-5243-0x00000000070E0000-0x00000000070E8000-memory.dmp

Download

memory/1548-5246-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/1548-5245-0x0000000007200000-0x0000000007292000-memory.dmp

Download

memory/1548-5242-0x0000000006E40000-0x0000000006E4A000-memory.dmp

Download

memory/1548-5247-0x00000000072E0000-0x00000000072EC000-memory.dmp

Download

memory/1548-5250-0x0000000007300000-0x0000000007366000-memory.dmp

Download

memory/1548-7122-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/1548-6960-0x0000000005270000-0x0000000005280000-memory.dmp

Download