dcrat | 43812998e440b805ec6629f5008c8408c34edc8d447dcd45ef0ed9e6273a2086

Analysis

max time kernel
145s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 2.0MB
Sample261003-vlflnavtex
SHA256 43812998e440b805ec6629f5008c8408c34edc8d447dcd45ef0ed9e6273a2086
MD5 1402c0e60b52db313522028577dd2999
SHA1 10a8d7b18e3a01b26a1c60258ba3d3f7264475bf
SHA512 e77893235ce52b9c07018e5246bab01877c7b237aebfb937a0e3c93ca39ddf8500a784c745074ad485a9a605934bdf0f784c13daad91d73f628e28ade27ecbbf
SSDEEP 49152:ykQTAdYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpG:yad5CbhZcT2lvnDFpFW/twU7+G
TLSH
T1B0A5337470C1C1B2E5A6103584CACB32A6367062877EC1CB7ADD76F56F603F1627AAC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Sidebar\\SecurityHealthService.exe\", \"C:\\Program Files\\Windows NT\\fontdrvhost.exe\""	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Sidebar\\SecurityHealthService.exe\""	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5740	1876	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	1876	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5580	1876	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	1876	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	1876	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	1876	schtasks.exe	89

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe

Detects executables packed with SmartAssembly 7 IoCs

resource	yara_rule
behavioral2/memory/4188-5233-0x0000000006620000-0x0000000006630000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/4188-5240-0x0000000006DF0000-0x0000000006DFA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/4188-5247-0x0000000007630000-0x000000000763C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/4188-5248-0x0000000007650000-0x000000000765C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/4188-5250-0x0000000007680000-0x000000000768C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/4188-5256-0x0000000007A80000-0x0000000007A8A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/4188-5252-0x0000000007B70000-0x0000000007B7A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
756	powershell.exe
6172	powershell.exe
6164	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Executes dropped EXE 3 IoCs

pid	Process
2452	SecurityHealthService.exe
1636	fontdrvhost.exe
7028	fontdrvhost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Program Files\\Windows Sidebar\\SecurityHealthService.exe\""	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Program Files\\Windows Sidebar\\SecurityHealthService.exe\""	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows NT\\fontdrvhost.exe\""	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows NT\\fontdrvhost.exe\""	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3416	WScript.exe
3092	WScript.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4188-5233-0x0000000006620000-0x0000000006630000-memory.dmp	SmartAssembly
behavioral2/memory/4188-5240-0x0000000006DF0000-0x0000000006DFA000-memory.dmp	SmartAssembly
behavioral2/memory/4188-5247-0x0000000007630000-0x000000000763C000-memory.dmp	SmartAssembly
behavioral2/memory/4188-5248-0x0000000007650000-0x000000000765C000-memory.dmp	SmartAssembly
behavioral2/memory/4188-5250-0x0000000007680000-0x000000000768C000-memory.dmp	SmartAssembly
behavioral2/memory/4188-5256-0x0000000007A80000-0x0000000007A8A000-memory.dmp	SmartAssembly
behavioral2/memory/4188-5252-0x0000000007B70000-0x0000000007B7A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\SecurityHealthService.exe	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Windows NT\fontdrvhost.exe	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Windows NT\5b884080fd4f94	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows Sidebar\RCXFDD1.tmp	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows NT\RCX4D8.tmp	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows NT\RCX98C.tmp	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows NT\fontdrvhost.exe	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Windows Sidebar\926e3e4b62361b	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows Sidebar\SecurityHealthService.exe	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fontdrvhost.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5580	schtasks.exe
3952	schtasks.exe
3168	schtasks.exe
996	schtasks.exe
5740	schtasks.exe
2296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
6164	powershell.exe
6164	powershell.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	1636	fontdrvhost.exe
Token: SeDebugPrivilege	2452	SecurityHealthService.exe
Token: SeDebugPrivilege	6164	powershell.exe
Token: SeDebugPrivilege	6172	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeIncreaseQuotaPrivilege	6164	powershell.exe
Token: SeSecurityPrivilege	6164	powershell.exe
Token: SeTakeOwnershipPrivilege	6164	powershell.exe
Token: SeLoadDriverPrivilege	6164	powershell.exe
Token: SeSystemProfilePrivilege	6164	powershell.exe
Token: SeSystemtimePrivilege	6164	powershell.exe
Token: SeProfSingleProcessPrivilege	6164	powershell.exe
Token: SeIncBasePriorityPrivilege	6164	powershell.exe
Token: SeCreatePagefilePrivilege	6164	powershell.exe
Token: SeBackupPrivilege	6164	powershell.exe
Token: SeRestorePrivilege	6164	powershell.exe
Token: SeShutdownPrivilege	6164	powershell.exe
Token: SeDebugPrivilege	6164	powershell.exe
Token: SeSystemEnvironmentPrivilege	6164	powershell.exe
Token: SeRemoteShutdownPrivilege	6164	powershell.exe
Token: SeUndockPrivilege	6164	powershell.exe
Token: SeManageVolumePrivilege	6164	powershell.exe
Token: 33	6164	powershell.exe
Token: 34	6164	powershell.exe
Token: 35	6164	powershell.exe
Token: 36	6164	powershell.exe
Token: SeIncreaseQuotaPrivilege	756	powershell.exe
Token: SeSecurityPrivilege	756	powershell.exe
Token: SeTakeOwnershipPrivilege	756	powershell.exe
Token: SeLoadDriverPrivilege	756	powershell.exe
Token: SeSystemProfilePrivilege	756	powershell.exe
Token: SeSystemtimePrivilege	756	powershell.exe
Token: SeProfSingleProcessPrivilege	756	powershell.exe
Token: SeIncBasePriorityPrivilege	756	powershell.exe
Token: SeCreatePagefilePrivilege	756	powershell.exe
Token: SeBackupPrivilege	756	powershell.exe
Token: SeRestorePrivilege	756	powershell.exe
Token: SeShutdownPrivilege	756	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeSystemEnvironmentPrivilege	756	powershell.exe
Token: SeRemoteShutdownPrivilege	756	powershell.exe
Token: SeUndockPrivilege	756	powershell.exe
Token: SeManageVolumePrivilege	756	powershell.exe
Token: 33	756	powershell.exe
Token: 34	756	powershell.exe
Token: 35	756	powershell.exe
Token: 36	756	powershell.exe
Token: SeIncreaseQuotaPrivilege	6172	powershell.exe
Token: SeSecurityPrivilege	6172	powershell.exe
Token: SeTakeOwnershipPrivilege	6172	powershell.exe
Token: SeLoadDriverPrivilege	6172	powershell.exe
Token: SeSystemProfilePrivilege	6172	powershell.exe
Token: SeSystemtimePrivilege	6172	powershell.exe
Token: SeProfSingleProcessPrivilege	6172	powershell.exe
Token: SeIncBasePriorityPrivilege	6172	powershell.exe
Token: SeCreatePagefilePrivilege	6172	powershell.exe
Token: SeBackupPrivilege	6172	powershell.exe
Token: SeRestorePrivilege	6172	powershell.exe
Token: SeShutdownPrivilege	6172	powershell.exe
Token: SeDebugPrivilege	6172	powershell.exe
Token: SeSystemEnvironmentPrivilege	6172	powershell.exe
Token: SeRemoteShutdownPrivilege	6172	powershell.exe
Token: SeUndockPrivilege	6172	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 756	4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	102
PID 4188 wrote to memory of 6164	4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	103
PID 4188 wrote to memory of 6172	4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	104
PID 4188 wrote to memory of 7028	4188	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	109
PID 7028 wrote to memory of 3416	7028	fontdrvhost.exe	111
PID 7028 wrote to memory of 3092	7028	fontdrvhost.exe	112

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-02_1402c0e60b52db313522028577dd2999_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\SecurityHealthService.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6164
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6172
- C:\Program Files\Windows NT\fontdrvhost.exe
  "C:\Program Files\Windows NT\fontdrvhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:7028
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\302a9cf3-1bdc-43ac-bf52-9ec2bddbf345.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3416
  - - C:\Program Files\Windows NT\fontdrvhost.exe
      "C:\Program Files\Windows NT\fontdrvhost.exe"
      4⤵
      PID:6412
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efd18f54-9dc8-46ed-b018-688467c79b7b.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\SecurityHealthService.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthService" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Program Files\Windows Sidebar\SecurityHealthService.exe
"C:\Program Files\Windows Sidebar\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Program Files\Windows NT\fontdrvhost.exe
"C:\Program Files\Windows NT\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Program Files\Windows NT\fontdrvhost.exe
Size 2.0MB
SHA256 43812998e440b805ec6629f5008c8408c34edc8d447dcd45ef0ed9e6273a2086
MD5 1402c0e60b52db313522028577dd2999
SHA1 10a8d7b18e3a01b26a1c60258ba3d3f7264475bf
SHA512 e77893235ce52b9c07018e5246bab01877c7b237aebfb937a0e3c93ca39ddf8500a784c745074ad485a9a605934bdf0f784c13daad91d73f628e28ade27ecbbf
SSDEEP 49152:ykQTAdYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpG:yad5CbhZcT2lvnDFpFW/twU7+G
TLSH
T1B0A5337470C1C1B2E5A6103584CACB32A6367062877EC1CB7ADD76F56F603F1627AAC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthService.exe

Path C:\Program Files\Windows Sidebar\SecurityHealthService.exe
Size 2.0MB
SHA256 d3c0448e228e38dbb7ffee2e5fd564e798ed56844163d29e0efeef1a445cc207
MD5 46d44a4ee01011e0c7e6de4717fc464e
SHA1 6f183ed4285049f17551beba063ce331a6ce75e4
SHA512 b8cf1b145505453159dde4c219aa28c98de6db18842431ee62142ea9524b8e595cdb69639c8601041c6cc29b179afcd34999ad83debf5f3c3ff1af178be1a4e7
SSDEEP 49152:ykQTA9YS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpK:ya95CbhZcT2lvnDFpFW/twU7+K
TLSH
T11DA5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 a2487731d570d2cbb512d71ae99d178963b06c0071685aadb4effebcfe23abe1
MD5 c2d51e3bcd24ff6fffdd067a33902175
SHA1 797427c061a5a1b5a8bcd34eb5aba3af6a540588
SHA512 9b38d7c62882392587cfb0187f7afe4e917b99599a1b0c0d28c72cc8d338b1245a6a2f52faea460d9c8c8711c9ea366ce820b23bade89f37231dabc0d3f7c7fe
SSDEEP 384:h1eBaoT1iBGmGW14b7EMWfaLN6l+f7rr2PnNIAXr48+xWbWtzKwUvYbhNaPIlRtm:7exZ6GlWicM9Lol+n6lIAXrX+BVrbhNa
TLSH
T11CA2A478213F6DC7D8D226B410D20AF7FBE4D489DAB61194BF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 649dab4af802dc6207a069dd179e371db68b972c58b596da789cdadc314c3289
MD5 c4d791511c73af0f446606979125ad61
SHA1 24fac1ff7b373a8b2773a13ebb67940ded13815c
SHA512 d1f836695bf29437b844e26730dbb81c37881c86a401fa274e7ef3fea6e78bf495f762957316951623fb19e790bb27f6687bc779527fbcab2fbe7eaa93aab34c
SSDEEP 384:/SEboT1iBG+GW14b3rBmU4sT+rkjrr2PnZIAXr48+dW7ytzKwYvYbhNaPMWRtXZU:t0Z6GNWijh4m+06RIAXrX+hV3bhNaPl4
TLSH
T1DBA2B478213F6DC7D8D216B010D20AF7FBE4D489DAB65194BF1BDE2F4C90ABA4A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

302a9cf3-1bdc-43ac-bf52-9ec2bddbf345.vbs

Path C:\Users\Admin\AppData\Local\Temp\302a9cf3-1bdc-43ac-bf52-9ec2bddbf345.vbs
Size 719B
SHA256 18db651fe26f9cb76e1d6f1d9c140a2b66c31b35652e495e22f72610eeb0e460
MD5 83177781dc07d1e07eb759360ce7c5f5
SHA1 e4559a85052d3b767b5d670553dc1b8dfddd389d
SHA512 fb41609e29dfefe6d88e5ed25890fba3d314d178187a0640e53bc910f97cf457f30e77b55c1d777843ebaa155c7c84e19c30eb92bce0f6ea09697d4cfc1d3a39
TLSH
T14C01C006BE0BE67060B13340A1FA557B5AD8C01C2177BC9BB950E46D2745D2504EC5EE
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xvthqsnh.rn2.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xvthqsnh.rn2.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

efd18f54-9dc8-46ed-b018-688467c79b7b.vbs

Path C:\Users\Admin\AppData\Local\Temp\efd18f54-9dc8-46ed-b018-688467c79b7b.vbs
Size 495B
SHA256 965cbc4b7026054b394139eaea30940058287f060a3254bab730202349ba8338
MD5 aa1ee6081254639024a90f1f2d820454
SHA1 2a9c50a02605eef9bccb2b584e59be4db2875590
SHA512 4ad99c0f32bc326f2ae412628a91f63233d3f545b7b07ce99104e40f2feeb27d6db6afcf6c5a8d98124c056402b47c9b5778ab2998ce3b71d20e6e116d4ca922
TLSH
T1A3F09E1DFF05C334D511134313F9A88F876CC40E3665D9896948D8CE319193549FA1CD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/756-9115-0x0000000002750000-0x0000000002786000-memory.dmp

Download

memory/756-15738-0x000000006FDF0000-0x000000006FE3C000-memory.dmp

Download

memory/756-15747-0x0000000007690000-0x0000000007726000-memory.dmp

Download

memory/4188-10-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-5230-0x0000000002B50000-0x0000000002B6C000-memory.dmp

Download

memory/4188-8-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-36-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-85-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-132-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-125-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-116-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-114-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-112-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-110-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-108-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-106-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-104-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-102-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-100-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-98-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-96-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-94-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-92-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-90-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-88-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-86-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-82-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-80-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-78-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-76-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-74-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-72-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-70-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-68-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-66-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-64-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-61-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-62-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-56-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-54-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-52-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-50-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-58-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-48-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-45-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-46-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-42-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-40-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-38-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-32-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-30-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-28-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-24-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-18-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-16-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-14-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-12-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-5-0x00000000052E0000-0x0000000005596000-memory.dmp

Download

memory/4188-7-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-35-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-126-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-22-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-20-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-3-0x0000000005870000-0x0000000005E2A000-memory.dmp

Download

memory/4188-130-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-26-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-122-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-120-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-118-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-1384-0x0000000074B92000-0x0000000074B93000-memory.dmp

Download

memory/4188-1388-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/4188-5229-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/4188-128-0x00000000052E0000-0x0000000005591000-memory.dmp

Download

memory/4188-5231-0x0000000002B80000-0x0000000002BD0000-memory.dmp

Download

memory/4188-5233-0x0000000006620000-0x0000000006630000-memory.dmp

Download

memory/4188-5232-0x0000000002BE0000-0x0000000002BE8000-memory.dmp

Download

memory/4188-5235-0x0000000006670000-0x0000000006678000-memory.dmp

Download

memory/4188-5234-0x0000000006630000-0x0000000006646000-memory.dmp

Download

memory/4188-5236-0x0000000006680000-0x0000000006692000-memory.dmp

Download

memory/4188-5237-0x00000000066C0000-0x00000000066C8000-memory.dmp

Download

memory/4188-5238-0x0000000006E10000-0x0000000006E20000-memory.dmp

Download

memory/4188-5239-0x0000000006E30000-0x0000000006EC2000-memory.dmp

Download

memory/4188-5240-0x0000000006DF0000-0x0000000006DFA000-memory.dmp

Download

memory/4188-5241-0x0000000006E00000-0x0000000006E08000-memory.dmp

Download

memory/4188-5242-0x0000000006EF0000-0x0000000006EFC000-memory.dmp

Download

memory/4188-5243-0x0000000006F00000-0x0000000006F08000-memory.dmp

Download

memory/4188-5245-0x0000000006F20000-0x0000000006F32000-memory.dmp

Download

memory/4188-5246-0x0000000006F70000-0x000000000749C000-memory.dmp

Download

memory/4188-5247-0x0000000007630000-0x000000000763C000-memory.dmp

Download

memory/4188-5248-0x0000000007650000-0x000000000765C000-memory.dmp

Download

memory/4188-5249-0x0000000007660000-0x000000000766C000-memory.dmp

Download

memory/4188-5250-0x0000000007680000-0x000000000768C000-memory.dmp

Download

memory/4188-5251-0x0000000007690000-0x0000000007698000-memory.dmp

Download

memory/4188-5253-0x0000000007A30000-0x0000000007A3E000-memory.dmp

Download

memory/4188-5256-0x0000000007A80000-0x0000000007A8A000-memory.dmp

Download

memory/4188-5257-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/4188-5258-0x0000000007AB0000-0x0000000007ABC000-memory.dmp

Download

memory/4188-5255-0x0000000007A70000-0x0000000007A78000-memory.dmp

Download

memory/4188-5254-0x0000000007A60000-0x0000000007A68000-memory.dmp

Download

memory/4188-5252-0x0000000007B70000-0x0000000007B7A000-memory.dmp

Download

memory/4188-5260-0x0000000007AD0000-0x0000000007B36000-memory.dmp

Download

memory/4188-7635-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/4188-8294-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/4188-0-0x0000000074B92000-0x0000000074B93000-memory.dmp

Download

memory/4188-1-0x00000000055B0000-0x0000000005868000-memory.dmp

Download

memory/4188-16237-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/4188-2-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/4188-4-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/4188-6-0x0000000074B80000-0x000000007533C000-memory.dmp

Download

memory/6164-15729-0x0000000006680000-0x00000000069DB000-memory.dmp

Download

memory/6164-10554-0x0000000005BF0000-0x000000000623A000-memory.dmp

Download

memory/6164-14389-0x0000000006270000-0x0000000006292000-memory.dmp

Download

memory/6164-15741-0x000000006FDF0000-0x000000006FE3C000-memory.dmp

Download

memory/6164-14540-0x0000000006390000-0x00000000063F6000-memory.dmp

Download

memory/6172-15731-0x0000000005DE0000-0x0000000005E2C000-memory.dmp

Download

memory/6172-15744-0x0000000007700000-0x0000000007D7C000-memory.dmp

Download

memory/6172-15746-0x0000000007110000-0x000000000711A000-memory.dmp

Download

memory/6172-15745-0x00000000070A0000-0x00000000070BA000-memory.dmp

Download

memory/6172-15730-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

Download

memory/6172-15732-0x0000000006340000-0x0000000006376000-memory.dmp

Download

memory/6172-15737-0x0000000006FD0000-0x0000000007073000-memory.dmp

Download

memory/6172-15736-0x00000000063A0000-0x00000000063C0000-memory.dmp

Download

memory/6172-15733-0x000000006FDF0000-0x000000006FE3C000-memory.dmp

Download

memory/7028-20975-0x0000000008D00000-0x0000000008D12000-memory.dmp

Download