dcrat | fbfbefa4f6d54f11ddd70848cf1c3bdfd9ce228143d5755648f0f4e7e53f34fe

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 2.0MB
Sample260711-r18zzaev3v
SHA256 fbfbefa4f6d54f11ddd70848cf1c3bdfd9ce228143d5755648f0f4e7e53f34fe
MD5 fefe077eb9dcfbbc715257804c4e2f93
SHA1 02e5aa5f932d7d8968a00ca24ee84b5311ef4004
SHA512 f2bcfd463bf59b80b483d0b7f07ea2f2fcbbaab39e2124e99b736a4e2d1035da6dddfa9e033228d5eab2924b48e185e2932cd883a1f832c0418f237b8307be6c
SSDEEP 49152:ukQTAKYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpA:uaK5CbhZcT2lvnDFpFW/twU7+A
TLSH
T154A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 41 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		5024	schtasks.exe
		6288	schtasks.exe
		4212	schtasks.exe
		4296	schtasks.exe
		3656	schtasks.exe
		5092	schtasks.exe
		3976	schtasks.exe
		5436	schtasks.exe
		1652	schtasks.exe
		1428	schtasks.exe
		3192	schtasks.exe
		6584	schtasks.exe
		2452	schtasks.exe
		6556	schtasks.exe
		4512	schtasks.exe
		6516	schtasks.exe
		4344	schtasks.exe
		3676	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		5088	schtasks.exe
		5672	schtasks.exe
		6520	schtasks.exe
		4176	schtasks.exe
		3152	schtasks.exe
		4928	schtasks.exe
		1268	schtasks.exe
		1492	schtasks.exe
		1240	schtasks.exe
		1464	schtasks.exe
		4812	schtasks.exe
		6932	schtasks.exe
		1532	schtasks.exe
		456	schtasks.exe
		668	schtasks.exe
		2628	schtasks.exe
		5892	schtasks.exe
		3740	schtasks.exe
		2176	schtasks.exe
		1676	schtasks.exe
		5472	schtasks.exe
		6804	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\Desktop\\explorer.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\Desktop\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SecurityHealthService.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\Desktop\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\SecurityHealthService.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\ShellHost.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 40 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5436	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5472	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6804	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6288	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5892	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6556	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6516	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5672	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6520	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6932	4004	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6584	4004	schtasks.exe	88

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 7 IoCs

resource	yara_rule
behavioral2/memory/5016-5233-0x0000000006610000-0x0000000006620000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5016-5240-0x0000000006B30000-0x0000000006B3A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5016-5247-0x0000000008390000-0x000000000839C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5016-5248-0x00000000083B0000-0x00000000083BC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5016-5250-0x00000000083E0000-0x00000000083EC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5016-5252-0x0000000008690000-0x000000000869A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5016-5256-0x00000000086F0000-0x00000000086FA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Recovery\\WindowsRE\\SecurityHealthService.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Recovery\\WindowsRE\\SecurityHealthService.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellHost = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\ShellHost.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ShellHost = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\ShellHost.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default\\Desktop\\explorer.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default\\Desktop\\explorer.exe\""	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5016-5233-0x0000000006610000-0x0000000006620000-memory.dmp	SmartAssembly
behavioral2/memory/5016-5240-0x0000000006B30000-0x0000000006B3A000-memory.dmp	SmartAssembly
behavioral2/memory/5016-5247-0x0000000008390000-0x000000000839C000-memory.dmp	SmartAssembly
behavioral2/memory/5016-5248-0x00000000083B0000-0x00000000083BC000-memory.dmp	SmartAssembly
behavioral2/memory/5016-5250-0x00000000083E0000-0x00000000083EC000-memory.dmp	SmartAssembly
behavioral2/memory/5016-5252-0x0000000008690000-0x000000000869A000-memory.dmp	SmartAssembly
behavioral2/memory/5016-5256-0x00000000086F0000-0x00000000086FA000-memory.dmp	SmartAssembly

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\2a08264799fbe8	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\ShellHost.exe	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 40 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1676	schtasks.exe
1652	schtasks.exe
1240	schtasks.exe
668	schtasks.exe
5892	schtasks.exe
4212	schtasks.exe
2176	schtasks.exe
2452	schtasks.exe
3740	schtasks.exe
1532	schtasks.exe
5024	schtasks.exe
5472	schtasks.exe
1492	schtasks.exe
3192	schtasks.exe
6932	schtasks.exe
456	schtasks.exe
3676	schtasks.exe
2628	schtasks.exe
6288	schtasks.exe
1464	schtasks.exe
4812	schtasks.exe
4176	schtasks.exe
3656	schtasks.exe
5672	schtasks.exe
6584	schtasks.exe
5092	schtasks.exe
5436	schtasks.exe
4344	schtasks.exe
4512	schtasks.exe
4296	schtasks.exe
4928	schtasks.exe
1268	schtasks.exe
3152	schtasks.exe
6516	schtasks.exe
3976	schtasks.exe
5088	schtasks.exe
1428	schtasks.exe
6804	schtasks.exe
6556	schtasks.exe
6520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_fefe077eb9dcfbbc715257804c4e2f93_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Desktop\explorer.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\Desktop\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Desktop\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SecurityHealthService.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthService" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\ShellHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\spoolsv.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows.old\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows.old\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Users\Default\Desktop\explorer.exe
"C:\Users\Default\Desktop\explorer.exe"
1⤵
PID:4664

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
1⤵
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows.old\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\Tasks\ShellHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHost" /sc ONLOGON /tr "'C:\Windows\Tasks\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\Tasks\ShellHost.exe
"C:\Windows\Tasks\ShellHost.exe"
1⤵
PID:6308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe
"C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe"
1⤵
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\sppsvc.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\ctfmon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6932

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
"C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe"
1⤵
PID:6220

C:\Program Files (x86)\Microsoft.NET\RedistList\ShellHost.exe
"C:\Program Files (x86)\Microsoft.NET\RedistList\ShellHost.exe"
1⤵
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows.old\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6584

C:\Recovery\WindowsRE\SecurityHealthService.exe
"C:\Recovery\WindowsRE\SecurityHealthService.exe"
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ShellHost.exe

Path C:\Program Files (x86)\Microsoft.NET\RedistList\ShellHost.exe
Size 256KB
SHA256 e7da77a55e4bbce35e239308e1c942f264a6260f742e1fd7b9a69a83c5a72f8f
MD5 dea4c92b8bbf372a62079344522b2134
SHA1 ce43dbcda086102d88bf3135b7d5b96dd1609d2b
SHA512 bb8e009e48d3342a9572e7a9f8be0c95f30345fab4033bea4ad5f530a60fa958c84efba0d50f37f3c9ab7bc74b0e0af9554638589d26db32232463849f9b44af
SSDEEP 6144:cDKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvbv:Kh1Lk70TnvjcsMxdABSnLHOrv
TLSH
T1DD44D02071C0C1B2C4B7513544EACA7A9E36707247BA95D77BDD2BB6AE103E1A3352CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
Size 448KB
SHA256 47ee58f312800c9f4ed49df5285aebbbf566d0f56248de184eb16d95089566d7
MD5 258ba2bff7f2b73b33d8f6bd37b4d340
SHA1 c8d2e718788d32d996799bd161b5183948ac46a8
SHA512 535e03f47b64ae87b3ce59c01ad4e4396b4ed90c47b43465641acc41dbe3fce7bb48567d89c6abd57e26d20f9c2faf9419ddc4400e451572db14897345512dd2
SSDEEP 12288:Kh1Lk70TnvjcsMxdABSnLHOr2fqRVnRj1p:uk70Trc18BSnLW2CRBZ
TLSH
T157A401207180C077D4BA513544EACF769E3630B147B9C5DBBBD967B6AE202E1A3352CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthService.exe

Path C:\Recovery\WindowsRE\SecurityHealthService.exe
Size 128KB
SHA256 fa7bf942ddd9b443c453067ee4a4aeb6f2cf7c5f4f257f9ad187535e5c441f83
MD5 c6951a1a38d89d891b61831bf739886b
SHA1 fa56d8d84724e0bfe3747fd440735a7c5afbba91
SHA512 aa4ef53b3732445e4d792804a362accf796283d85350d74e1fa10f43ca1427407ea0b8f1ccbf46bfb4d2b221645335ad0adde08c81313adda2a9b6b01352bfe2
SSDEEP 1536:MxxKY+T6KW5CvEyXWvE344wAL5LO8XvdPTwZI3sq5gnToIfnIOlIOjcTm:MnDKW1LgppLRHMY0TBfJvjcTm
TLSH
T170D37C2075C1C2B3C4B6113484E6CB799A7A3071077A95D7BBDD2BB66E213E1A3362CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Users\Default\Desktop\explorer.exe
Size 2.0MB
SHA256 fbfbefa4f6d54f11ddd70848cf1c3bdfd9ce228143d5755648f0f4e7e53f34fe
MD5 fefe077eb9dcfbbc715257804c4e2f93
SHA1 02e5aa5f932d7d8968a00ca24ee84b5311ef4004
SHA512 f2bcfd463bf59b80b483d0b7f07ea2f2fcbbaab39e2124e99b736a4e2d1035da6dddfa9e033228d5eab2924b48e185e2932cd883a1f832c0418f237b8307be6c
SSDEEP 49152:ukQTAKYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpA:uaK5CbhZcT2lvnDFpFW/twU7+A
TLSH
T154A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D77F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5016-0-0x0000000074F22000-0x0000000074F23000-memory.dmp

Download

memory/5016-1-0x0000000005520000-0x00000000057D8000-memory.dmp

Download

memory/5016-3-0x00000000057E0000-0x0000000005D9A000-memory.dmp

Download

memory/5016-2-0x0000000074F10000-0x00000000756CC000-memory.dmp

Download

memory/5016-5-0x0000000074F10000-0x00000000756CC000-memory.dmp

Download

memory/5016-4-0x0000000005260000-0x0000000005516000-memory.dmp

Download

memory/5016-6-0x0000000074F10000-0x00000000756CC000-memory.dmp

Download

memory/5016-7-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-8-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-18-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-20-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-16-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-34-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-40-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-45-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-57-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-76-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-130-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-128-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-126-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-124-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-122-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-120-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-118-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-116-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-114-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-112-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-110-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-108-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-106-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-132-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-104-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-102-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-100-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-98-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-96-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-94-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-92-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-90-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-88-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-86-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-84-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-82-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-80-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-78-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-74-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-72-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-70-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-68-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-66-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-64-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-62-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-60-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-58-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-54-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-48-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-47-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-42-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-51-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-52-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-38-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-36-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-32-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-30-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-28-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-26-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-25-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-22-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-14-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-12-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-10-0x0000000005260000-0x0000000005511000-memory.dmp

Download

memory/5016-2101-0x0000000074F22000-0x0000000074F23000-memory.dmp

Download

memory/5016-2102-0x0000000074F10000-0x00000000756CC000-memory.dmp

Download

memory/5016-5229-0x0000000074F10000-0x00000000756CC000-memory.dmp

Download

memory/5016-5230-0x0000000004D80000-0x0000000004D9C000-memory.dmp

Download

memory/5016-5231-0x0000000004DB0000-0x0000000004E00000-memory.dmp

Download

memory/5016-5233-0x0000000006610000-0x0000000006620000-memory.dmp

Download

memory/5016-5232-0x0000000004E10000-0x0000000004E18000-memory.dmp

Download

memory/5016-5234-0x0000000006620000-0x0000000006636000-memory.dmp

Download

memory/5016-5235-0x0000000006660000-0x0000000006668000-memory.dmp

Download

memory/5016-5236-0x0000000006670000-0x0000000006682000-memory.dmp

Download

memory/5016-5237-0x0000000006B20000-0x0000000006B28000-memory.dmp

Download

memory/5016-5238-0x0000000006B90000-0x0000000006BA0000-memory.dmp

Download

memory/5016-5239-0x0000000006BA0000-0x0000000006C32000-memory.dmp

Download

memory/5016-5240-0x0000000006B30000-0x0000000006B3A000-memory.dmp

Download

memory/5016-5241-0x0000000006B50000-0x0000000006B58000-memory.dmp

Download

memory/5016-5242-0x0000000006B70000-0x0000000006B7C000-memory.dmp

Download

memory/5016-5243-0x0000000006C40000-0x0000000006C48000-memory.dmp

Download

memory/5016-5245-0x0000000006C50000-0x0000000006C62000-memory.dmp

Download

memory/5016-5246-0x0000000007E40000-0x000000000836C000-memory.dmp

Download

memory/5016-5247-0x0000000008390000-0x000000000839C000-memory.dmp

Download

memory/5016-5248-0x00000000083B0000-0x00000000083BC000-memory.dmp

Download

memory/5016-5249-0x00000000083C0000-0x00000000083CC000-memory.dmp

Download

memory/5016-5250-0x00000000083E0000-0x00000000083EC000-memory.dmp

Download

memory/5016-5251-0x00000000083F0000-0x00000000083F8000-memory.dmp

Download

memory/5016-5253-0x00000000086A0000-0x00000000086AE000-memory.dmp

Download

memory/5016-5252-0x0000000008690000-0x000000000869A000-memory.dmp

Download

memory/5016-5255-0x00000000086E0000-0x00000000086E8000-memory.dmp

Download

memory/5016-5254-0x00000000086D0000-0x00000000086D8000-memory.dmp

Download

memory/5016-5256-0x00000000086F0000-0x00000000086FA000-memory.dmp

Download

memory/5016-5257-0x0000000008700000-0x000000000870C000-memory.dmp

Download

memory/5016-5258-0x0000000074F10000-0x00000000756CC000-memory.dmp

Download

memory/5016-5260-0x0000000008750000-0x00000000087B6000-memory.dmp

Download

memory/5016-7004-0x0000000074F10000-0x00000000756CC000-memory.dmp

Download

memory/5016-7679-0x0000000074F10000-0x00000000756CC000-memory.dmp

Download