dcrat | ffecc1c67d2d447445ec3827ef8e3181f4e97f9acefaab5d9427027b1e4d358d

Analysis

max time kernel
54s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260719-a162yaa16w
SHA256 ffecc1c67d2d447445ec3827ef8e3181f4e97f9acefaab5d9427027b1e4d358d
MD5 c272683c4a1ce42bccd0d2a3d2defe43
SHA1 b57c864d1e044dd051b4ba6b398e450613e373b5
SHA512 606ca33e4c73302753574a0d41a7a4ffb30a113b363c1f86ffab931cfffe60a03a975bca5ea4ea5811d091ebc6d76fd00e2938b1eb9d4a8f45180f3e8a917c7a
SSDEEP 49152:8kQzArIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scF:86huRD9JdOR4m+lmY/4rx8cF
TLSH
T1BB8523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\csrss.exe\""	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\csrss.exe\", \"C:\\Windows.old\\sppsvc.exe\""	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	4124	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	4124	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	4124	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5428	4124	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	4124	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6092	4124	schtasks.exe	90

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/3176-5233-0x00000000065F0000-0x0000000006600000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3176-5237-0x00000000066C0000-0x00000000066CA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3176-5242-0x0000000006FD0000-0x0000000006FDC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3176-5245-0x00000000073B0000-0x00000000073BC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3176-5243-0x0000000007390000-0x000000000739A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1944	powershell.exe
1936	powershell.exe
1380	powershell.exe
1708	powershell.exe
1896	powershell.exe
1092	powershell.exe
3836	powershell.exe
3516	powershell.exe
3700	powershell.exe
1616	powershell.exe
2036	powershell.exe
2576	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5564	csrss.exe
5844	sppsvc.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\csrss.exe\""	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\csrss.exe\""	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows.old\\sppsvc.exe\""	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows.old\\sppsvc.exe\""	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2020	WScript.exe
6120	WScript.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/3176-5233-0x00000000065F0000-0x0000000006600000-memory.dmp	SmartAssembly
behavioral2/memory/3176-5237-0x00000000066C0000-0x00000000066CA000-memory.dmp	SmartAssembly
behavioral2/memory/3176-5242-0x0000000006FD0000-0x0000000006FDC000-memory.dmp	SmartAssembly
behavioral2/memory/3176-5245-0x00000000073B0000-0x00000000073BC000-memory.dmp	SmartAssembly
behavioral2/memory/3176-5243-0x0000000007390000-0x000000000739A000-memory.dmp	SmartAssembly

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sppsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3588	schtasks.exe
3560	schtasks.exe
4960	schtasks.exe
5428	schtasks.exe
1680	schtasks.exe
6092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5564	csrss.exe
Token: SeDebugPrivilege	5844	sppsvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3836	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	103
PID 3176 wrote to memory of 1936	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	104
PID 3176 wrote to memory of 1944	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	106
PID 3176 wrote to memory of 2576	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	108
PID 3176 wrote to memory of 1092	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	110
PID 3176 wrote to memory of 2036	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	111
PID 3176 wrote to memory of 1896	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	112
PID 3176 wrote to memory of 3516	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	113
PID 3176 wrote to memory of 1708	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	115
PID 3176 wrote to memory of 1616	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	116
PID 3176 wrote to memory of 3700	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	117
PID 3176 wrote to memory of 1380	3176	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	118

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c272683c4a1ce42bccd0d2a3d2defe43_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3176
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:3836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:2576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:2036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:3516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1708
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:3700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1380
- C:\Users\All Users\regid.1991-06.com.microsoft\csrss.exe
  "C:\Users\All Users\regid.1991-06.com.microsoft\csrss.exe"
  2⤵
  PID:6180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows.old\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows.old\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows.old\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6092

C:\Users\All Users\regid.1991-06.com.microsoft\csrss.exe
"C:\Users\All Users\regid.1991-06.com.microsoft\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows.old\sppsvc.exe
"C:\Windows.old\sppsvc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5844
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2bea044-0786-4940-b4be-22145bdd69c1.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2020
- - C:\Windows.old\sppsvc.exe
    C:\Windows.old\sppsvc.exe
    3⤵
    PID:7080
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\106689ba-e31f-4b5b-abe2-1c0358b9ed65.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\ProgramData\regid.1991-06.com.microsoft\csrss.exe
Size 1.7MB
SHA256 2cb67f06537bf4562fdac6014b80884d81bb262962a188346628c1619c92c5a2
MD5 5e1201ff1ee5cec01265de5a79fd4c8f
SHA1 9561ade173c97f4c3ed1c690ccaaf3519807def1
SHA512 cc65994aefdd4adc9b56e5971582c35957f840739ba612918fb84ab891b2d59ca75038acb7048663433a19e6ad42a7c3c24d7c2923d2ecf0246b5bf6687469a4
SSDEEP 49152:ckQzAXIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scu:c6NuRD9JdOR4m+lmY/4rx8cu
TLSH
T12D8523057181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 8cd30dfb3dce6793f29da24e18962dcb36724c774a9c1a97ef71ca68955bffd6
MD5 32e9876c14ccc357743585a607147d91
SHA1 00d9002c7b0dded8cfa98a7038fa8f87ff98610c
SHA512 987689a537afa1e976b8f639bc9179b52b224615654c7ef02af3f1d982750badae73c764dc7ceb75a94d463db5c439b9e5092f1093b994231dcbc607e255ea0a
SSDEEP 1536:4tdKYo2hq3vdfKQVGflJdCHYWh4iUxPR40i71YiyyPcMrxoV3CNBQkj2Ya5eDjIj:4vKYo2hq3vdfKQVGflJdwYWqiUPRCqp9
TLSH
T1E85374D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 4KB
SHA256 294b8ebe9dcbbba290027110bbd092f68ba1095a43a76b53c11c0c77d827e05e
MD5 9d6cb70b3497b0990885b70b97d2ad40
SHA1 cff4753b3cd70597ee5894c25813534a0b6c7641
SHA512 6e458f6d49f85d27fce3d50817d6999af4ab234b59518fd6dfd351f8775cad7efaef17db62621dfd5c51907e681638bd0a60b5fff4977640a2f4515f64420f7a
TLSH
T176812FD3A4380D15E4A2BD7DD0214A227C703F9B81F1656192C86BCE5A8F5B11A3FB2E
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 bd8ec1f5bd762b1adec39de501d1fd788447ff9743e6a39b73e4358c26b686ad
MD5 85a2b50987403e97ffca46f2d94af898
SHA1 cc16f0fb0fddc71d01dfee57c90fdb7b6bdccffe
SHA512 8cb9137ac2b4d3a6860315da2be3bfa8b09338b5048d9405bb0956b3b358441f751fd6c2b5b447a95d63718391198f7e4db11e9db7dabdd4ad66fcbff03d3675
SSDEEP 1536:EtdKYo2hqHMBfKQVGflJdCHYyh4iUxPR40i71YiyyPUOdBcV3CNBQkj2Ya5eDjI2:EvKYo2hqHMBfKQVGflJdwYyqiUPRCqpA
TLSH
T1345373D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 8KB
SHA256 04a69ee6f5d625b7d250075eb68fd86be5184e75a464d4e5a456b878d5cfdba6
MD5 a3226dc67f7f9234f1e6d2105ad8334f
SHA1 565598483ad20b8c81180fee5de772c80d3d0805
SHA512 e764a0ee2929c42fc39bda7617f7f1f065065e13f7ae2b6cf9f9c744a16c530814902102beaf78406e70292d9542932c0d485eed61a3b5914efe145bc755afa6
SSDEEP 192:W9daCYXNXp5Pk9sm+MVsm5emdDhGQg68iI2oIbS/R:TfNXp5WYQu2Tu/R
TLSH
T161F154D3E8344D69E2A0AE3CF05525927C30369B90E4552221D9676F298F0971B2F7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

106689ba-e31f-4b5b-abe2-1c0358b9ed65.vbs

Path C:\Users\Admin\AppData\Local\Temp\106689ba-e31f-4b5b-abe2-1c0358b9ed65.vbs
Size 477B
SHA256 342088f3907d5a2f72b7967058fed6293e6c2bff8e9ea466a07d23e87086d6ca
MD5 145839b187ab175055d31bd351d085bb
SHA1 1e451cafd0dcf83b30a11df82a26695a0a40ea7c
SHA512 6f7e578b08e3da5ebc9e82658f8e10c1cb815b8dd8175676708434dd2f23efb7e35e4e9b71925086ad925a76a8a817d94beb07740e79b7707398efcfa0e738d8
TLSH
T120F02E1DAF05C734D811035212F9858F456C945D3271D9999919D8DD315167409EA1CD
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_oe3zieft.vld.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oe3zieft.vld.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e2bea044-0786-4940-b4be-22145bdd69c1.vbs

Path C:\Users\Admin\AppData\Local\Temp\e2bea044-0786-4940-b4be-22145bdd69c1.vbs
Size 701B
SHA256 d092c2dd72dee7ac71930d9cdf7dd24a1ff54e71ac5a4f0deaa84c61ac0dc4b5
MD5 be4d318331b7581f5b77f7c035249a92
SHA1 2117d3cfb19dc57ffb5bfc211de245880f76d4f4
SHA512 95e364cf027d5a569459b100b5008cb0e43b8f5783b8d98dff07be3e9f764e489ecf08dbeee9ad71872aebd598fe468b1a5e42546e2a1a240370e88cd71e58c6
TLSH
T19901CB06BE0BE67024B1235091FA49BB6AD880183132BC4BB950E46C2706A2404AC4EE
MD5 SHA1 SHA512 TLSH

Submit Download

sppsvc.exe

Path C:\Windows.old\sppsvc.exe
Size 1.7MB
SHA256 ffecc1c67d2d447445ec3827ef8e3181f4e97f9acefaab5d9427027b1e4d358d
MD5 c272683c4a1ce42bccd0d2a3d2defe43
SHA1 b57c864d1e044dd051b4ba6b398e450613e373b5
SHA512 606ca33e4c73302753574a0d41a7a4ffb30a113b363c1f86ffab931cfffe60a03a975bca5ea4ea5811d091ebc6d76fd00e2938b1eb9d4a8f45180f3e8a917c7a
SSDEEP 49152:8kQzArIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scF:86huRD9JdOR4m+lmY/4rx8cF
TLSH
T1BB8523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-19493-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/1092-20263-0x0000000007B20000-0x000000000819C000-memory.dmp

Download

memory/1380-20186-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/1616-19466-0x0000000006BD0000-0x0000000006BF0000-memory.dmp

Download

memory/1616-19423-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/1616-11979-0x0000000006180000-0x00000000061E6000-memory.dmp

Download

memory/1616-11794-0x0000000005FA0000-0x0000000005FC2000-memory.dmp

Download

memory/1616-20906-0x0000000006CB0000-0x0000000006CBA000-memory.dmp

Download

memory/1616-19604-0x0000000007930000-0x00000000079D3000-memory.dmp

Download

memory/1616-19344-0x0000000001220000-0x0000000001256000-memory.dmp

Download

memory/1708-19911-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/1896-7486-0x0000000002F50000-0x0000000002F86000-memory.dmp

Download

memory/1896-19832-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/1936-19645-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/1936-15275-0x00000000064D0000-0x000000000651C000-memory.dmp

Download

memory/1936-15189-0x00000000062A0000-0x00000000062BE000-memory.dmp

Download

memory/1936-13397-0x0000000005F00000-0x000000000625B000-memory.dmp

Download

memory/1944-19693-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/2036-19960-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/2576-20279-0x0000000006BA0000-0x0000000006BBA000-memory.dmp

Download

memory/2576-19492-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/3176-28-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-5234-0x0000000006650000-0x0000000006666000-memory.dmp

Download

memory/3176-104-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-102-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-100-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-98-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-96-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-94-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-92-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-90-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-88-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-86-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-84-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-82-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-80-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-76-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-74-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-72-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-70-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-68-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-66-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-64-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-60-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-58-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-56-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-54-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-52-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-50-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-48-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-45-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-42-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-40-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-36-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-34-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-30-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-108-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-25-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-20-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-18-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-22-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-14-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-16-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-12-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-8-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-1840-0x00000000749E2000-0x00000000749E3000-memory.dmp

Download

memory/3176-2033-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-5229-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-5230-0x0000000002D40000-0x0000000002D5C000-memory.dmp

Download

memory/3176-5231-0x0000000002D70000-0x0000000002DC0000-memory.dmp

Download

memory/3176-5232-0x0000000002DD0000-0x0000000002DD8000-memory.dmp

Download

memory/3176-5233-0x00000000065F0000-0x0000000006600000-memory.dmp

Download

memory/3176-106-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-5235-0x0000000006630000-0x0000000006638000-memory.dmp

Download

memory/3176-5236-0x0000000006670000-0x0000000006680000-memory.dmp

Download

memory/3176-5237-0x00000000066C0000-0x00000000066CA000-memory.dmp

Download

memory/3176-5238-0x00000000069F0000-0x00000000069FC000-memory.dmp

Download

memory/3176-5239-0x0000000006A00000-0x0000000006A12000-memory.dmp

Download

memory/3176-5240-0x0000000006A30000-0x0000000006F5C000-memory.dmp

Download

memory/3176-5241-0x0000000006FC0000-0x0000000006FCC000-memory.dmp

Download

memory/3176-5242-0x0000000006FD0000-0x0000000006FDC000-memory.dmp

Download

memory/3176-5245-0x00000000073B0000-0x00000000073BC000-memory.dmp

Download

memory/3176-5244-0x00000000073A0000-0x00000000073A8000-memory.dmp

Download

memory/3176-5243-0x0000000007390000-0x000000000739A000-memory.dmp

Download

memory/3176-5246-0x00000000073C0000-0x0000000007452000-memory.dmp

Download

memory/3176-5247-0x0000000007480000-0x000000000748C000-memory.dmp

Download

memory/3176-5248-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-5250-0x0000000007600000-0x0000000007666000-memory.dmp

Download

memory/3176-5256-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-7277-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-8038-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-110-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-112-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-116-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-118-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-120-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-8690-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-16257-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-122-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-124-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-126-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-128-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-130-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-132-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-114-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-78-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-62-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-0-0x00000000749E2000-0x00000000749E3000-memory.dmp

Download

memory/3176-1-0x00000000054C0000-0x000000000573C000-memory.dmp

Download

memory/3176-46-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-38-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-32-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-27-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-2-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-4-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-11-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-7-0x0000000005230000-0x00000000054A4000-memory.dmp

Download

memory/3176-3-0x0000000005740000-0x0000000005CFA000-memory.dmp

Download

memory/3176-6-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/3176-5-0x0000000005230000-0x00000000054AA000-memory.dmp

Download

memory/3516-21333-0x0000000007830000-0x00000000078C6000-memory.dmp

Download

memory/3516-19624-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/3516-8449-0x0000000005440000-0x0000000005A8A000-memory.dmp

Download

memory/3700-19968-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download

memory/3836-20142-0x000000006F5E0000-0x000000006F62C000-memory.dmp

Download