dcrat | c4a87d9b75ec5f0eda66e01e302b0ad7d47dd45af4a2ccfe6aef87b028d03794

Analysis

max time kernel
147s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260816-cwpcfayvfs
SHA256 c4a87d9b75ec5f0eda66e01e302b0ad7d47dd45af4a2ccfe6aef87b028d03794
MD5 36f1e3cf6dfe3a13f299679a5ebd739b
SHA1 ab60aefd51a073ac6a2562e2c9520836815c0c99
SHA512 e027b85e8713ed7a3087c115b172d05dbda1311a1470292e9eb94e49d028b929ecf5d34fa4e7e79f5120caa504b95f31ed45fac8f799690188264797a3180af5
SSDEEP 49152:ckQzAAIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scM:c6YuRD9JdOR4m+lmY/4rx8cM
TLSH
T1618523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 43 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1784	schtasks.exe
		4144	schtasks.exe
		2328	schtasks.exe
		6472	schtasks.exe
		1604	schtasks.exe
		5116	schtasks.exe
		1820	schtasks.exe
		1784	schtasks.exe
		4440	schtasks.exe
		6092	schtasks.exe
		1544	schtasks.exe
		2252	schtasks.exe
		696	schtasks.exe
		4968	schtasks.exe
		4380	schtasks.exe
		3464	schtasks.exe
		3700	schtasks.exe
		4316	schtasks.exe
		5096	schtasks.exe
		228	schtasks.exe
		4568	schtasks.exe
		4276	schtasks.exe
		1292	schtasks.exe
		5192	schtasks.exe
		5700	schtasks.exe
		3132	schtasks.exe
		2292	schtasks.exe
		7224	schtasks.exe
		1460	schtasks.exe
		2324	schtasks.exe
		5176	schtasks.exe
		4672	schtasks.exe
		3788	schtasks.exe
		5668	schtasks.exe
		6124	schtasks.exe
		3256	schtasks.exe
		2176	schtasks.exe
		2564	schtasks.exe
		2964	schtasks.exe
		1816	schtasks.exe
		3020	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		3236	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\sihost.exe\""	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\sihost.exe\", \"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\taskhostw.exe\""	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6124	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5700	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6092	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5192	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5176	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5668	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6472	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7224	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	5620	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	5620	schtasks.exe	87

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral1/memory/3024-5232-0x0000000006220000-0x0000000006230000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/3024-5236-0x0000000006730000-0x000000000673A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/3024-5241-0x0000000006D40000-0x0000000006D4C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/3024-5244-0x0000000007120000-0x000000000712C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/3024-5242-0x0000000006D70000-0x0000000006D7A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\taskhostw.exe\""	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default\\Documents\\sihost.exe\""	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default\\Documents\\sihost.exe\""	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\taskhostw.exe\""	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/3024-5232-0x0000000006220000-0x0000000006230000-memory.dmp	SmartAssembly
behavioral1/memory/3024-5236-0x0000000006730000-0x000000000673A000-memory.dmp	SmartAssembly
behavioral1/memory/3024-5241-0x0000000006D40000-0x0000000006D4C000-memory.dmp	SmartAssembly
behavioral1/memory/3024-5244-0x0000000007120000-0x000000000712C000-memory.dmp	SmartAssembly
behavioral1/memory/3024-5242-0x0000000006D70000-0x0000000006D7A000-memory.dmp	SmartAssembly

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4144	schtasks.exe
5116	schtasks.exe
1460	schtasks.exe
3020	schtasks.exe
2324	schtasks.exe
1544	schtasks.exe
2292	schtasks.exe
4568	schtasks.exe
5192	schtasks.exe
3132	schtasks.exe
6472	schtasks.exe
2964	schtasks.exe
4316	schtasks.exe
3700	schtasks.exe
3236	schtasks.exe
1784	schtasks.exe
1292	schtasks.exe
6092	schtasks.exe
1816	schtasks.exe
1820	schtasks.exe
6124	schtasks.exe
2328	schtasks.exe
4672	schtasks.exe
3256	schtasks.exe
3464	schtasks.exe
4440	schtasks.exe
2564	schtasks.exe
5700	schtasks.exe
2176	schtasks.exe
5096	schtasks.exe
4276	schtasks.exe
4380	schtasks.exe
2252	schtasks.exe
3788	schtasks.exe
696	schtasks.exe
4968	schtasks.exe
5176	schtasks.exe
7224	schtasks.exe
1784	schtasks.exe
228	schtasks.exe
5668	schtasks.exe
1604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3024	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3024	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3024	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3024	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_36f1e3cf6dfe3a13f299679a5ebd739b_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Documents\sihost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Documents\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\taskhostw.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Users\Default\Documents\sihost.exe
"C:\Users\Default\Documents\sihost.exe"
1⤵
PID:5132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Pictures\Saved Pictures\wininit.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Saved Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Pictures\Saved Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\edge_BITS_4436_1887746316\explorer.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4436_1887746316\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\edge_BITS_4436_1887746316\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Prefetch\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\Prefetch\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\edge_BITS_4124_441256213\System.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4124_441256213\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\edge_BITS_4124_441256213\System.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5176

C:\Windows\Temp\MsEdgeCrashpad\reports\taskhostw.exe
"C:\Windows\Temp\MsEdgeCrashpad\reports\taskhostw.exe"
1⤵
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Users\Admin\Pictures\Saved Pictures\wininit.exe
"C:\Users\Admin\Pictures\Saved Pictures\wininit.exe"
1⤵
PID:1292

C:\Recovery\WindowsRE\SppExtComObj.exe
"C:\Recovery\WindowsRE\SppExtComObj.exe"
1⤵
PID:1708

C:\Recovery\WindowsRE\taskhostw.exe
"C:\Recovery\WindowsRE\taskhostw.exe"
1⤵
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Setup\State\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Recovery\WindowsRE\backgroundTaskHost.exe
"C:\Recovery\WindowsRE\backgroundTaskHost.exe"
1⤵
PID:5816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\Windows\SIHClient.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Windows\Help\Windows\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 7 /tr "'C:\Windows\Help\Windows\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Program Files\edge_BITS_4436_1887746316\explorer.exe
"C:\Program Files\edge_BITS_4436_1887746316\explorer.exe"
1⤵
PID:7048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\Prefetch\RuntimeBroker.exe
"C:\Windows\Prefetch\RuntimeBroker.exe"
1⤵
PID:7452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
1⤵
PID:8364

C:\Program Files\edge_BITS_4124_441256213\System.exe
"C:\Program Files\edge_BITS_4124_441256213\System.exe"
1⤵
PID:9616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.exe

Path C:\Program Files\edge_BITS_4124_441256213\System.exe
Size 1.6MB
SHA256 97f8d28728f6c42c66a29ee5be623edef7fc7a1dc52f8165c070cebd0d137a04
MD5 152f421fad88cd695fe208f9ce7c972a
SHA1 f4c084f5c8b744fb220ca7da5fc86cc39a08a5cd
SHA512 087817cc26dd9ab77822bb238fb8d36692ba094a66ab1ed2d9f8796c2ce8bc3bdb7f36d9f3edf4e0f17bd99eb8d6c5a5d4403b3c72cef2ceb7b4c8dd3e563633
SSDEEP 49152:ckQzAAIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsxa:c6YuRD9JdOR4m+lmY/4rxa
TLSH
T10C7523157181D333C2BB103085C18FB59A2566260F7666DFFBE89B662F202F4BB261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Registry.exe

Path C:\Recovery\WindowsRE\Registry.exe
Size 1.3MB
SHA256 9feada6fc0ccb2c5dc672bcae32d69f6a0e11832fb1e778cc36b5ac60d5e3a84
MD5 1df896fc7ad49d780d1726598d94b9d6
SHA1 9b590188b9ce6ce58b113e3ece59572a7065f0c8
SHA512 ccb2c5109b5d192e078b5b53f41e72c36e87ee631f42db985bf26bee9fbea0c30278729d7b9f629b0e0c94fbc47fda205755658ceb3f34975f1e51062f5e6bf5
SSDEEP 24576:ck70zrcHgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJ4sytPXic8Z:ckQzAAIwMtuvMDVPG4JdXeR4aT6LQ+di
TLSH
T1CC5523197181D3B3C2BB003189D5CB715A2671710B7AA5DFF7A8AB662F202F4B7271C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Registry.exe

Path C:\Recovery\WindowsRE\Registry.exe
Size 896KB
SHA256 620a962ceaf9ab4f6507c70d883cbc01b022612130b15d623b6dd1d877d76e30
MD5 03bdb5a92aab0785e01316be848bab7a
SHA1 107a2ef65deaf79767c0f806e50401ccf3dd112b
SHA512 3ced87c1e8cd68ad8fe183fb9ae41ecf686ef7a5f4cc3f262e8b7f7cdce92ce1f472fe1f35e3a43ccd9aa8cac60ad2754150fbc4ef3df05a81b0bc7ae7bf768d
SSDEEP 24576:ck70zrcHgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiOh:ckQzAAIwMtuvMDVPG4JdXeR4aN
TLSH
T14B1522157180D273C5FB1131C8D5CB355A2675B10BAAA5EBBAEC6BB26F102E0B7321CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sihost.exe

Path C:\Users\Default\Documents\sihost.exe
Size 1.7MB
SHA256 c4a87d9b75ec5f0eda66e01e302b0ad7d47dd45af4a2ccfe6aef87b028d03794
MD5 36f1e3cf6dfe3a13f299679a5ebd739b
SHA1 ab60aefd51a073ac6a2562e2c9520836815c0c99
SHA512 e027b85e8713ed7a3087c115b172d05dbda1311a1470292e9eb94e49d028b929ecf5d34fa4e7e79f5120caa504b95f31ed45fac8f799690188264797a3180af5
SSDEEP 49152:ckQzAAIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scM:c6YuRD9JdOR4m+lmY/4rx8cM
TLSH
T1618523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3024-0-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3024-1-0x0000000005550000-0x00000000057CC000-memory.dmp

Download

memory/3024-2-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3024-3-0x00000000057D0000-0x0000000005D74000-memory.dmp

Download

memory/3024-4-0x00000000052C0000-0x000000000553A000-memory.dmp

Download

memory/3024-5-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-23-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-28-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-54-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-80-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-78-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-94-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-114-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-130-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-128-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-126-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-124-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-122-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-120-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-118-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-116-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-112-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-110-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-108-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-106-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-104-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-102-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-100-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-98-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-96-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-92-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-90-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-88-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-86-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-84-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-82-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-76-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-74-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-72-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-70-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-68-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-66-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-64-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-62-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-60-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-58-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-56-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-52-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-50-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-48-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-46-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-44-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-42-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-40-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-38-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-36-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-34-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-32-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-30-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-26-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-24-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-18-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-20-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-16-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-14-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-12-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-10-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-9-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-6-0x00000000052C0000-0x0000000005534000-memory.dmp

Download

memory/3024-1695-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3024-1860-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3024-2121-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3024-5228-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3024-5229-0x0000000004BE0000-0x0000000004BFC000-memory.dmp

Download

memory/3024-5230-0x0000000004C10000-0x0000000004C60000-memory.dmp

Download

memory/3024-5231-0x0000000004C70000-0x0000000004C78000-memory.dmp

Download

memory/3024-5232-0x0000000006220000-0x0000000006230000-memory.dmp

Download

memory/3024-5234-0x0000000006260000-0x0000000006268000-memory.dmp

Download

memory/3024-5233-0x00000000062E0000-0x00000000062F6000-memory.dmp

Download

memory/3024-5235-0x0000000006300000-0x0000000006310000-memory.dmp

Download

memory/3024-5236-0x0000000006730000-0x000000000673A000-memory.dmp

Download

memory/3024-5237-0x0000000006760000-0x000000000676C000-memory.dmp

Download

memory/3024-5238-0x0000000006770000-0x0000000006782000-memory.dmp

Download

memory/3024-5239-0x00000000067A0000-0x0000000006CCC000-memory.dmp

Download

memory/3024-5240-0x0000000006D30000-0x0000000006D3C000-memory.dmp

Download

memory/3024-5241-0x0000000006D40000-0x0000000006D4C000-memory.dmp

Download

memory/3024-5243-0x0000000007110000-0x0000000007118000-memory.dmp

Download

memory/3024-5244-0x0000000007120000-0x000000000712C000-memory.dmp

Download

memory/3024-5242-0x0000000006D70000-0x0000000006D7A000-memory.dmp

Download

memory/3024-5247-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3024-5246-0x00000000071F0000-0x00000000071FC000-memory.dmp

Download

memory/3024-5250-0x0000000007230000-0x0000000007296000-memory.dmp

Download

memory/3024-5245-0x0000000007130000-0x00000000071C2000-memory.dmp

Download

memory/3024-6935-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3024-7077-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download