dcrat | cadcbd888163b825c3b23a8e531d836ad4afa44a8e95b382abc600fc1987d619

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260714-e7fwjset6m
SHA256 cadcbd888163b825c3b23a8e531d836ad4afa44a8e95b382abc600fc1987d619
MD5 0bb760b98ce0e747a4f7c98d4c807ba5
SHA1 6cf76c3905d65a11a4919202756a7cf798690476
SHA512 26242763835448934d13d93a8d94df2d76add212e12722286d1739ef356c337120bde330e8ef6d2bddd9608933e0d519189669e2c2a36d69e2088513bcc30520
SSDEEP 49152:ckQTAYIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scy:cawuRD9JdOR4m+lmY/4rx8cy
TLSH
T1018523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 48 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		6952	schtasks.exe
		2108	schtasks.exe
		1064	schtasks.exe
		4688	schtasks.exe
		1416	schtasks.exe
		6504	schtasks.exe
		6672	schtasks.exe
		1564	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		3168	schtasks.exe
		1780	schtasks.exe
		2316	schtasks.exe
		5996	schtasks.exe
		9044	schtasks.exe
		3192	schtasks.exe
		1476	schtasks.exe
		6052	schtasks.exe
		6852	schtasks.exe
		3664	schtasks.exe
		8376	schtasks.exe
		4720	schtasks.exe
		400	schtasks.exe
		4416	schtasks.exe
		6196	schtasks.exe
		10216	schtasks.exe
		3716	schtasks.exe
		4600	schtasks.exe
		2704	schtasks.exe
		3600	schtasks.exe
		5812	schtasks.exe
		6552	schtasks.exe
		11552	schtasks.exe
		4644	schtasks.exe
		1492	schtasks.exe
		1876	schtasks.exe
		2796	schtasks.exe
		5268	schtasks.exe
		10212	schtasks.exe
		2408	schtasks.exe
		4556	schtasks.exe
		7056	schtasks.exe
		5128	schtasks.exe
		7296	schtasks.exe
		6796	schtasks.exe
		2100	schtasks.exe
		4532	schtasks.exe
		3844	schtasks.exe
		7264	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Videos\\WUDFHost.exe\""	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 47 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5812	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6052	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6504	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6672	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7264	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7056	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6852	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5268	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10212	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6196	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6552	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5128	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10216	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5996	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7296	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8376	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9044	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6796	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	11552	4072	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6952	4072	schtasks.exe	89

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral1/memory/736-5230-0x0000000006220000-0x0000000006230000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/736-5234-0x00000000069F0000-0x00000000069FA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/736-5239-0x0000000007000000-0x000000000700C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/736-5242-0x00000000073E0000-0x00000000073EC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/736-5240-0x0000000007030000-0x000000000703A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WUDFHost = "\"C:\\Users\\Public\\Videos\\WUDFHost.exe\""	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WUDFHost = "\"C:\\Users\\Public\\Videos\\WUDFHost.exe\""	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/736-5230-0x0000000006220000-0x0000000006230000-memory.dmp	SmartAssembly
behavioral1/memory/736-5234-0x00000000069F0000-0x00000000069FA000-memory.dmp	SmartAssembly
behavioral1/memory/736-5239-0x0000000007000000-0x000000000700C000-memory.dmp	SmartAssembly
behavioral1/memory/736-5242-0x00000000073E0000-0x00000000073EC000-memory.dmp	SmartAssembly
behavioral1/memory/736-5240-0x0000000007030000-0x000000000703A000-memory.dmp	SmartAssembly

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ShellExperiences\56085415360792	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Windows\ShellExperiences\wininit.exe	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3168	schtasks.exe
1416	schtasks.exe
3192	schtasks.exe
3844	schtasks.exe
6552	schtasks.exe
11552	schtasks.exe
4720	schtasks.exe
3600	schtasks.exe
5812	schtasks.exe
6504	schtasks.exe
5128	schtasks.exe
2796	schtasks.exe
6672	schtasks.exe
4556	schtasks.exe
7264	schtasks.exe
7296	schtasks.exe
8376	schtasks.exe
6796	schtasks.exe
1876	schtasks.exe
2108	schtasks.exe
4416	schtasks.exe
10212	schtasks.exe
3716	schtasks.exe
2100	schtasks.exe
4688	schtasks.exe
2316	schtasks.exe
2408	schtasks.exe
400	schtasks.exe
2704	schtasks.exe
6052	schtasks.exe
4600	schtasks.exe
1492	schtasks.exe
1780	schtasks.exe
7056	schtasks.exe
1564	schtasks.exe
5996	schtasks.exe
6952	schtasks.exe
4532	schtasks.exe
1064	schtasks.exe
4644	schtasks.exe
5268	schtasks.exe
6196	schtasks.exe
10216	schtasks.exe
9044	schtasks.exe
1476	schtasks.exe
6852	schtasks.exe
3664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0bb760b98ce0e747a4f7c98d4c807ba5_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\WUDFHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Users\Public\Videos\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Videos\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\wininit.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellExperiences\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\WmiPrvSE.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\PrintDialog\pris\SearchApp.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\PrintDialog\pris\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Windows\PrintDialog\pris\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Program Files (x86)\Adobe\WmiPrvSE.exe
"C:\Program Files (x86)\Adobe\WmiPrvSE.exe"
1⤵
PID:2896

C:\Windows\PrintDialog\pris\SearchApp.exe
"C:\Windows\PrintDialog\pris\SearchApp.exe"
1⤵
PID:4832

C:\Windows\ShellExperiences\wininit.exe
"C:\Windows\ShellExperiences\wininit.exe"
1⤵
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Users\Public\Videos\WUDFHost.exe
"C:\Users\Public\Videos\WUDFHost.exe"
1⤵
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\services.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Program Files\Uninstall Information\System.exe
"C:\Program Files\Uninstall Information\System.exe"
1⤵
PID:7724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\sihost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:10212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Java\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\WUDFHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files\Google\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Recovery\WindowsRE\OfficeClickToRun.exe
"C:\Recovery\WindowsRE\OfficeClickToRun.exe"
1⤵
PID:8636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8376

C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe
"C:\Program Files (x86)\Windows Media Player\en-US\fontdrvhost.exe"
1⤵
PID:6968

C:\Recovery\WindowsRE\System.exe
"C:\Recovery\WindowsRE\System.exe"
1⤵
PID:8308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:10216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:9044

C:\Program Files\Mozilla Firefox\fontdrvhost.exe
"C:\Program Files\Mozilla Firefox\fontdrvhost.exe"
1⤵
PID:9200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:11552

C:\Program Files\Uninstall Information\services.exe
"C:\Program Files\Uninstall Information\services.exe"
1⤵
PID:7884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Program Files\Mozilla Firefox\fontdrvhost.exe
Size 1.4MB
SHA256 e3b719198afa219bbef580da8893a2160054a8f4c1e8f99c8fa3a49cb8b0675d
MD5 ed239d15aec9935e5c4a6d90ff22de58
SHA1 e5d08f3931927009eeae0c3736a041c50c9fbd0c
SHA512 c53799e73fc772c85bf587e3daf038e47151822566b3c88a79f70e2bb728810f78ea03b4234777ceeeaadcfcdd91cab125fd570149ae3293759d60ad26bd2415
SSDEEP 24576:ck70Trc/gBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJ4sytPXic8M:ckQTAYIwMtuvMDVPG4JdXeR4aT6LQ+db
TLSH
T1126523147181D373C6BB10308AD18F756A2671710F7AA6DFFBD89B662F202E4B7261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.exe

Path C:\Program Files\Uninstall Information\System.exe
Size 1.7MB
SHA256 cadcbd888163b825c3b23a8e531d836ad4afa44a8e95b382abc600fc1987d619
MD5 0bb760b98ce0e747a4f7c98d4c807ba5
SHA1 6cf76c3905d65a11a4919202756a7cf798690476
SHA512 26242763835448934d13d93a8d94df2d76add212e12722286d1739ef356c337120bde330e8ef6d2bddd9608933e0d519189669e2c2a36d69e2088513bcc30520
SSDEEP 49152:ckQTAYIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scy:cawuRD9JdOR4m+lmY/4rx8cy
TLSH
T1018523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

services.exe

Path C:\Program Files\Uninstall Information\services.exe
Size 512KB
SHA256 075e3cacd53f8af54a03379445e3da63f509a03d25443b6030606244f229f5a5
MD5 bcfffb8b17f9f72e8f46b8bb0cf99edd
SHA1 f069c685629d3bde295be7bdf7c0c6ce2c01994f
SHA512 c236e5eae8ad3ed432e62ffcb8be1bf404c6f36158f1453350efabfdd850f5c746977c676e5a0716333471cb4d77c5554289bc30eed9061e99706f350cb5fc7d
SSDEEP 12288:gh1Lk70TnvjccUgAgux61IP20vhe/ShQnvgTRPxX3VOKGHYN:ck70Trc/gBukmO0ZthkvMjHVOKG4N
TLSH
T11CB402117280C2B3C5B7017484D5CB35AE3A7475076AA5DBBAD92BBA2F213F0A7361CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/736-0-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/736-1-0x00000000053B0000-0x000000000562C000-memory.dmp

Download

memory/736-2-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/736-3-0x0000000005630000-0x0000000005BD4000-memory.dmp

Download

memory/736-4-0x0000000005120000-0x000000000539A000-memory.dmp

Download

memory/736-5-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-14-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-34-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-68-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-74-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-100-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-98-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-96-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-94-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-92-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-90-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-88-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-86-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-84-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-82-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-80-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-78-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-76-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-72-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-70-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-66-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-65-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-62-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-60-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-58-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-56-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-54-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-52-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-50-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-48-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-46-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-44-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-42-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-40-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-38-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-36-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-32-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-30-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-28-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-26-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-24-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-22-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-20-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-18-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-12-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-10-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-6-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-16-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-8-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-123-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-110-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-130-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-128-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-126-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-124-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-118-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-116-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-114-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-108-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-106-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-104-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-102-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-120-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-112-0x0000000005120000-0x0000000005394000-memory.dmp

Download

memory/736-1722-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/736-5226-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/736-5227-0x0000000002930000-0x000000000294C000-memory.dmp

Download

memory/736-5228-0x0000000002960000-0x00000000029B0000-memory.dmp

Download

memory/736-5229-0x00000000029C0000-0x00000000029C8000-memory.dmp

Download

memory/736-5230-0x0000000006220000-0x0000000006230000-memory.dmp

Download

memory/736-5233-0x0000000006300000-0x0000000006310000-memory.dmp

Download

memory/736-5232-0x0000000006260000-0x0000000006268000-memory.dmp

Download

memory/736-5231-0x00000000062E0000-0x00000000062F6000-memory.dmp

Download

memory/736-5234-0x00000000069F0000-0x00000000069FA000-memory.dmp

Download

memory/736-5235-0x0000000006A20000-0x0000000006A2C000-memory.dmp

Download

memory/736-5236-0x0000000006A30000-0x0000000006A42000-memory.dmp

Download

memory/736-5237-0x0000000006A60000-0x0000000006F8C000-memory.dmp

Download

memory/736-5239-0x0000000007000000-0x000000000700C000-memory.dmp

Download

memory/736-5238-0x0000000006FF0000-0x0000000006FFC000-memory.dmp

Download

memory/736-5242-0x00000000073E0000-0x00000000073EC000-memory.dmp

Download

memory/736-5243-0x00000000073F0000-0x0000000007482000-memory.dmp

Download

memory/736-5241-0x00000000073D0000-0x00000000073D8000-memory.dmp

Download

memory/736-5244-0x00000000074B0000-0x00000000074BC000-memory.dmp

Download

memory/736-5240-0x0000000007030000-0x000000000703A000-memory.dmp

Download

memory/736-5248-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/736-5247-0x00000000074D0000-0x0000000007536000-memory.dmp

Download

memory/736-8095-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/736-8882-0x0000000005110000-0x0000000005120000-memory.dmp

Download