dcrat | 6df1b2c3360ef226a88ca131f296906eb3e2c0114045cab2b7358b7352c3edfe

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260720-ddln9sc19r
SHA256 6df1b2c3360ef226a88ca131f296906eb3e2c0114045cab2b7358b7352c3edfe
MD5 87ce0565f55d08ee7dbb4aeea9ae6226
SHA1 e63b73784c45c6da96c5acf62fb16f602dea91fc
SHA512 1e8f87d27dc0bd616aabaaacf2972dce32e85e0a9a8c4f34a79a95cf8ab23e117aefe66d5aee075678c6582b17756d88d3303acff6b865b7d2d084f33e54d94c
SSDEEP 49152:ckQzAnIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scg:c69uRD9JdOR4m+lmY/4rx8cg
TLSH
T1FA8523057181D333C2FB003085C58FB55A2566224F7666EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 38 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2776	schtasks.exe
		2860	schtasks.exe
		6200	schtasks.exe
		2940	schtasks.exe
		4164	schtasks.exe
		5496	schtasks.exe
		6612	schtasks.exe
		3572	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		3808	schtasks.exe
		6752	schtasks.exe
		7132	schtasks.exe
		3264	schtasks.exe
		4120	schtasks.exe
		4424	schtasks.exe
		1236	schtasks.exe
		6108	schtasks.exe
		6456	schtasks.exe
		6812	schtasks.exe
		3264	schtasks.exe
		1504	schtasks.exe
		2996	schtasks.exe
		548	schtasks.exe
		4988	schtasks.exe
		2412	schtasks.exe
		6600	schtasks.exe
		5988	schtasks.exe
		6656	schtasks.exe
		4548	schtasks.exe
		1648	schtasks.exe
		4124	schtasks.exe
		4608	schtasks.exe
		1376	schtasks.exe
		5184	schtasks.exe
		2348	schtasks.exe
		1404	schtasks.exe
		3052	schtasks.exe
		4556	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files\\7-Zip\\Lang\\SearchHost.exe\""	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 37 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5184	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6108	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6656	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6752	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6200	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7132	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6600	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6456	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5988	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6812	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5496	4220	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6612	4220	schtasks.exe	90

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/616-5232-0x00000000064B0000-0x00000000064C0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/616-5236-0x0000000006580000-0x000000000658A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/616-5241-0x0000000006E90000-0x0000000006E9C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/616-5244-0x0000000007270000-0x000000000727C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/616-5242-0x0000000007250000-0x000000000725A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\Program Files\\7-Zip\\Lang\\SearchHost.exe\""	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\Program Files\\7-Zip\\Lang\\SearchHost.exe\""	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/616-5232-0x00000000064B0000-0x00000000064C0000-memory.dmp	SmartAssembly
behavioral2/memory/616-5236-0x0000000006580000-0x000000000658A000-memory.dmp	SmartAssembly
behavioral2/memory/616-5241-0x0000000006E90000-0x0000000006E9C000-memory.dmp	SmartAssembly
behavioral2/memory/616-5244-0x0000000007270000-0x000000000727C000-memory.dmp	SmartAssembly
behavioral2/memory/616-5242-0x0000000007250000-0x000000000725A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\SearchHost.exe	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\7-Zip\Lang\cfa885d449487c	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 37 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6752	schtasks.exe
548	schtasks.exe
2940	schtasks.exe
4424	schtasks.exe
1404	schtasks.exe
4988	schtasks.exe
3808	schtasks.exe
6200	schtasks.exe
6600	schtasks.exe
5988	schtasks.exe
5496	schtasks.exe
1648	schtasks.exe
6108	schtasks.exe
2776	schtasks.exe
3264	schtasks.exe
7132	schtasks.exe
4120	schtasks.exe
6612	schtasks.exe
6656	schtasks.exe
4548	schtasks.exe
2348	schtasks.exe
4608	schtasks.exe
4164	schtasks.exe
5184	schtasks.exe
1236	schtasks.exe
2412	schtasks.exe
2996	schtasks.exe
1376	schtasks.exe
3572	schtasks.exe
4556	schtasks.exe
4124	schtasks.exe
3264	schtasks.exe
2860	schtasks.exe
6456	schtasks.exe
6812	schtasks.exe
1504	schtasks.exe
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\SearchHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 11 /tr "'C:\Windows.old\smartscreen.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Windows.old\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 5 /tr "'C:\Windows.old\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\sppsvc.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Recovery\WindowsRE\RuntimeBroker.exe
"C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
PID:568

C:\Program Files\7-Zip\Lang\SearchHost.exe
"C:\Program Files\7-Zip\Lang\SearchHost.exe"
1⤵
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\CbsTemp\System.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\CbsTemp\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\CbsTemp\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\wininit.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 10 /tr "'C:\Windows\ImmersiveControlPanel\smartscreen.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 11 /tr "'C:\Windows\ImmersiveControlPanel\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Idle.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\wininit.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\wininit.exe"
1⤵
PID:5432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Idle.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Idle.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6456

C:\Recovery\WindowsRE\winlogon.exe
"C:\Recovery\WindowsRE\winlogon.exe"
1⤵
PID:6316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee2" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Downloads\2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee2" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Downloads\2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Program Files (x86)\Mozilla Maintenance Service\Idle.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\Idle.exe"
1⤵
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Windows.old\OfficeClickToRun.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows.old\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Windows.old\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Pictures\services.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Pictures\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Pictures\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5496

C:\Users\Admin\Downloads\2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\Downloads\2026-07-20_87ce0565f55d08ee7dbb4aeea9ae6226_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
PID:6348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\en-US\Idle.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6612

C:\Windows\CbsTemp\System.exe
"C:\Windows\CbsTemp\System.exe"
1⤵
PID:6584

C:\Windows.old\OfficeClickToRun.exe
"C:\Windows.old\OfficeClickToRun.exe"
1⤵
PID:6648

C:\Users\Admin\sppsvc.exe
"C:\Users\Admin\sppsvc.exe"
1⤵
PID:5908

C:\Windows.old\smartscreen.exe
"C:\Windows.old\smartscreen.exe"
1⤵
PID:6336

C:\Windows\ImmersiveControlPanel\smartscreen.exe
"C:\Windows\ImmersiveControlPanel\smartscreen.exe"
1⤵
PID:6936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Recovery\WindowsRE\RuntimeBroker.exe
Size 1.7MB
SHA256 6df1b2c3360ef226a88ca131f296906eb3e2c0114045cab2b7358b7352c3edfe
MD5 87ce0565f55d08ee7dbb4aeea9ae6226
SHA1 e63b73784c45c6da96c5acf62fb16f602dea91fc
SHA512 1e8f87d27dc0bd616aabaaacf2972dce32e85e0a9a8c4f34a79a95cf8ab23e117aefe66d5aee075678c6582b17756d88d3303acff6b865b7d2d084f33e54d94c
SSDEEP 49152:ckQzAnIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scg:c69uRD9JdOR4m+lmY/4rx8cg
TLSH
T1FA8523057181D333C2FB003085C58FB55A2566224F7666EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sppsvc.exe

Path C:\Users\Admin\sppsvc.exe
Size 128KB
SHA256 0e5b9415fc9817164826a4ebf87b7ec82028e14d2610ad632a3129876c5a85f5
MD5 2938aaa5fa41e8d78c62d42365506a59
SHA1 fc1ce71c3c4c06bf5005b79e84a60da566150ba8
SHA512 2eff5ae36b2c8dc4a042541279865ea2de89ffb01d3aa7423e44abf4cf3781697d7f1f8e67ad4c029eced01413157b4bdfdeb6bbba29d823a17d5c437bb73a89
SSDEEP 1536:kxKY+T6KW5CvEyXWvE344wAL5LO8XvdPTwZI3sq5gnzoIfnIOlIOjcTm:GDKW1LgppLRHMY0zBfJvjcTm
TLSH
T186D37C2075C1C1B3C4B6113484E6CB799A7A3071077A95D7BBDD2BB66E213E1A3362CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Windows.old\OfficeClickToRun.exe
Size 192KB
SHA256 c256fd9f1a198fab7c6e6853f95f64ace0624aa1d8402bd7b990f17260a1452d
MD5 25b041e68fb34394cf75b5a12692d321
SHA1 c664aeaa4353827f2f98c633e6f0afb5c4dcd152
SHA512 385081b4439e4d572dff0d2fb1e3cff0c395b04822404cf36d312e20f12846523b4a6db183c9936c00bd34d7e88c3d7e0fb8242e885b9f6f26301c65f35ed9da
SSDEEP 3072:GDKW1LgppLRHMY0zBfJvjcTp5X9UlcRYVcSSaHuYmBu8avhD:GDKW1Lgbdl0zBBvjc/9USsSAgutvhD
TLSH
T10614BE2175C1C2B3C4B6113144E6CB759A3A7071077A96D7BBDD2BBA6E203E1A3362CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-0-0x00000000742F2000-0x00000000742F3000-memory.dmp

Download

memory/616-1-0x0000000005550000-0x00000000057CC000-memory.dmp

Download

memory/616-2-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download

memory/616-3-0x00000000057D0000-0x0000000005D8A000-memory.dmp

Download

memory/616-4-0x00000000052D0000-0x000000000554A000-memory.dmp

Download

memory/616-10-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download

memory/616-7-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-11-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-13-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-5-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-8-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-15-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-21-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-35-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-39-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-47-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-59-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-57-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-55-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-53-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-51-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-49-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-45-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-43-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-41-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-37-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-33-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-31-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-29-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-27-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-25-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-23-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-19-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-17-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-73-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-100-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-103-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-105-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-111-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-115-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-123-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-131-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-129-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-127-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-125-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-121-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-119-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-117-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-113-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-109-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-107-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-101-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-97-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-96-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-93-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-89-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-87-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-85-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-83-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-79-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-77-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-91-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-81-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-75-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-71-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-69-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-67-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-65-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-63-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-61-0x00000000052D0000-0x0000000005544000-memory.dmp

Download

memory/616-1918-0x00000000742F2000-0x00000000742F3000-memory.dmp

Download

memory/616-1922-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download

memory/616-5228-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download

memory/616-5229-0x0000000002BB0000-0x0000000002BCC000-memory.dmp

Download

memory/616-5230-0x0000000002BE0000-0x0000000002C30000-memory.dmp

Download

memory/616-5231-0x0000000002C40000-0x0000000002C48000-memory.dmp

Download

memory/616-5232-0x00000000064B0000-0x00000000064C0000-memory.dmp

Download

memory/616-5235-0x0000000006530000-0x0000000006540000-memory.dmp

Download

memory/616-5234-0x00000000064F0000-0x00000000064F8000-memory.dmp

Download

memory/616-5233-0x0000000006510000-0x0000000006526000-memory.dmp

Download

memory/616-5236-0x0000000006580000-0x000000000658A000-memory.dmp

Download

memory/616-5237-0x00000000068B0000-0x00000000068BC000-memory.dmp

Download

memory/616-5238-0x00000000068C0000-0x00000000068D2000-memory.dmp

Download

memory/616-5239-0x00000000068F0000-0x0000000006E1C000-memory.dmp

Download

memory/616-5240-0x0000000006E80000-0x0000000006E8C000-memory.dmp

Download

memory/616-5241-0x0000000006E90000-0x0000000006E9C000-memory.dmp

Download

memory/616-5244-0x0000000007270000-0x000000000727C000-memory.dmp

Download

memory/616-5243-0x0000000007260000-0x0000000007268000-memory.dmp

Download

memory/616-5242-0x0000000007250000-0x000000000725A000-memory.dmp

Download

memory/616-5246-0x0000000007280000-0x0000000007312000-memory.dmp

Download

memory/616-5245-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download

memory/616-5247-0x0000000007360000-0x000000000736C000-memory.dmp

Download

memory/616-5249-0x0000000007380000-0x00000000073E6000-memory.dmp

Download

memory/616-7258-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download

memory/616-7891-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download