Overview

overview

10

Static

static

3

2026-10-01...ee.exe

windows10-2004-x64

10

2026-10-01...ee.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    45s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/10/2026, 19:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_abcb9cba7ff9b7173ba58df8a1e8f2c0_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
  • Size 1.7MB
  • Sample261003-x7d13awcmd
  • SHA256 7b50c18558b76b1cb2d3f13b12be882892e07fa33cf5823515d516f7f7bfda50
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutiondcratinfostealerpersistencerattrojan

Malware Config

Signatures

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Detects executables packed with SmartAssembly 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • SmartAssembly .NET packer 6 IoCs

    Detects SmartAssembly .NET packer.

  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_abcb9cba7ff9b7173ba58df8a1e8f2c0_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_abcb9cba7ff9b7173ba58df8a1e8f2c0_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1876
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3384
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4304
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4000
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3312
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3692
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4996
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2412
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2452
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:644
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3584
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1368
    • C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RuntimeBroker.exe
      "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RuntimeBroker.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5744
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\winlogon.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1336
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3832
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3680
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2444
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3792
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2460
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\Tasks\dwm.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4248
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Tasks\dwm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4888
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\Tasks\dwm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2040
  • C:\Program Files\Mozilla Firefox\winlogon.exe
    "C:\Program Files\Mozilla Firefox\winlogon.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4676
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0bb05abf-23ea-43d0-a91b-feb7202892a5.vbs"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      PID:8864
      • C:\Program Files\Mozilla Firefox\winlogon.exe
        "C:\Program Files\Mozilla Firefox\winlogon.exe"
        3⤵
          PID:8284
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20299fea-68df-476f-8ff1-f23e59da46b1.vbs"
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:8228
    • C:\Windows\Tasks\dwm.exe
      "C:\Windows\Tasks\dwm.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4736
    • C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RuntimeBroker.exe
      "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RuntimeBroker.exe"
      1⤵
        PID:6100

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            1
            T1562

            Disable or Modify Tools

            1
            T1562.001

            Modify Registry

            4
            T1112

            Credential Access

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            winlogon.exe
            • Path C:\Program Files\Mozilla Firefox\winlogon.exe
            • Size 1.7MB
            • SHA256 7b50c18558b76b1cb2d3f13b12be882892e07fa33cf5823515d516f7f7bfda50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RuntimeBroker.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RuntimeBroker.exe.log
            • Size 942B
            • SHA256 c295416053705f71b5287254d10d37efcbce5a07deda8785b1e5fc0985eeb00c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            winlogon.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\winlogon.exe.log
            • Size 1KB
            • SHA256 aaac00dacd37c23d8f6d509d918fb51aed021ae042e0ada9c366f07dfeb5c536
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 0d8e346606c000698f3e3d9eba4509d07b4ec83a8393677b80aca44b38150880
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 403960c143148d05411364ba7029549cf9244886c0a977884b53366aa585a58c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 f05579d7ee198f7864b138aca4825234fea55b76d446adad5228d64d843fbe33
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 a05498283e3c407f57786b7126de626c31d21a594000d0229a060c37cf2936de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 e3fc8c194ab727ce987070ef66996a937fb8bc2fd697d97f0379f79b00fd976e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 b07c50752e788fc1d6095b8b539e9a31da189f71e5a0954d330bda6445e0c59a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            0bb05abf-23ea-43d0-a91b-feb7202892a5.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\0bb05abf-23ea-43d0-a91b-feb7202892a5.vbs
            • Size 721B
            • SHA256 f0a76faf7f90502a4e95c6c3d83aac4bbac94df4899c9d49eaacd9ac7244f284
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            20299fea-68df-476f-8ff1-f23e59da46b1.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\20299fea-68df-476f-8ff1-f23e59da46b1.vbs
            • Size 497B
            • SHA256 da4ea5774be5cd1f930326ccff21615d57b0528a3a0477b5cc7fff32cee5cc2f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RCX31F4.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RCX31F4.tmp
            • Size 1.7MB
            • SHA256 599261f56fc8c482617ca5173cf66e4d3938169b9b683481445d7ca96d9b1b24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_3f2hivei.z2v.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3f2hivei.z2v.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/644-26408-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/1368-26360-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/1876-68-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-5238-0x0000000006760000-0x0000000006772000-memory.dmp
            Download

            memory/1876-48-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-46-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-44-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-42-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-40-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-38-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-36-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-34-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-32-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-31-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-28-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-26-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-24-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-20-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-16-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-14-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-10-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-9-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-6-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-64-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-72-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-116-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-130-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-128-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-126-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-124-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-122-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-120-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-118-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-114-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-112-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-110-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-108-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-106-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-104-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-102-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-100-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-98-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-96-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-94-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-92-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-90-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-89-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-86-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-82-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-80-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-78-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-76-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-74-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-70-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-54-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-66-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-62-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-84-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-1891-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
            Download

            memory/1876-5232-0x0000000006220000-0x0000000006230000-memory.dmp
            Download

            memory/1876-2147-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
            Download

            memory/1876-5228-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
            Download

            memory/1876-52-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-5229-0x0000000002940000-0x000000000295C000-memory.dmp
            Download

            memory/1876-2146-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
            Download

            memory/1876-5231-0x00000000029D0000-0x00000000029D8000-memory.dmp
            Download

            memory/1876-5234-0x0000000006260000-0x0000000006268000-memory.dmp
            Download

            memory/1876-5235-0x0000000006300000-0x0000000006310000-memory.dmp
            Download

            memory/1876-5233-0x00000000062E0000-0x00000000062F6000-memory.dmp
            Download

            memory/1876-5236-0x0000000006720000-0x000000000672A000-memory.dmp
            Download

            memory/1876-5237-0x0000000006750000-0x000000000675C000-memory.dmp
            Download

            memory/1876-5230-0x0000000002970000-0x00000000029C0000-memory.dmp
            Download

            memory/1876-5239-0x0000000006870000-0x0000000006D9C000-memory.dmp
            Download

            memory/1876-5240-0x00000000067F0000-0x00000000067FC000-memory.dmp
            Download

            memory/1876-5241-0x0000000006800000-0x000000000680C000-memory.dmp
            Download

            memory/1876-5242-0x0000000006850000-0x000000000685A000-memory.dmp
            Download

            memory/1876-5243-0x0000000007020000-0x0000000007028000-memory.dmp
            Download

            memory/1876-5244-0x0000000007030000-0x000000000703C000-memory.dmp
            Download

            memory/1876-5245-0x0000000007150000-0x00000000071E2000-memory.dmp
            Download

            memory/1876-5246-0x00000000071F0000-0x00000000071FC000-memory.dmp
            Download

            memory/1876-5249-0x0000000007210000-0x0000000007276000-memory.dmp
            Download

            memory/1876-5250-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
            Download

            memory/1876-0-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
            Download

            memory/1876-1-0x0000000005290000-0x000000000550C000-memory.dmp
            Download

            memory/1876-2-0x0000000002AA0000-0x0000000002AB0000-memory.dmp
            Download

            memory/1876-3-0x0000000005510000-0x0000000005AB4000-memory.dmp
            Download

            memory/1876-4-0x0000000005AC0000-0x0000000005D3A000-memory.dmp
            Download

            memory/1876-5-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-12-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-18-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-22-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-50-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-58-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-60-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/1876-56-0x0000000005AC0000-0x0000000005D34000-memory.dmp
            Download

            memory/2412-26425-0x0000000007040000-0x0000000007048000-memory.dmp
            Download

            memory/2412-26343-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/2412-26424-0x0000000007060000-0x000000000707A000-memory.dmp
            Download

            memory/2412-26423-0x0000000006F60000-0x0000000006F74000-memory.dmp
            Download

            memory/2412-26422-0x0000000006F50000-0x0000000006F5E000-memory.dmp
            Download

            memory/2452-26324-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/2452-7359-0x0000000005E80000-0x00000000061D4000-memory.dmp
            Download

            memory/2452-7358-0x0000000005DA0000-0x0000000005E06000-memory.dmp
            Download

            memory/2452-26333-0x00000000075F0000-0x0000000007693000-memory.dmp
            Download

            memory/2452-26323-0x00000000073B0000-0x00000000073E2000-memory.dmp
            Download

            memory/2452-7357-0x00000000055B0000-0x00000000055D2000-memory.dmp
            Download

            memory/2452-26332-0x0000000007370000-0x000000000738E000-memory.dmp
            Download

            memory/2452-26418-0x0000000007820000-0x000000000782A000-memory.dmp
            Download

            memory/3312-18942-0x0000000006030000-0x000000000607C000-memory.dmp
            Download

            memory/3312-18658-0x0000000005BF0000-0x0000000005C0E000-memory.dmp
            Download

            memory/3312-26359-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/3384-26420-0x00000000075B0000-0x0000000007646000-memory.dmp
            Download

            memory/3384-26399-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/3384-6130-0x00000000029B0000-0x00000000029E6000-memory.dmp
            Download

            memory/3584-26417-0x0000000006D20000-0x0000000006D3A000-memory.dmp
            Download

            memory/3584-26375-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/3584-26416-0x0000000007360000-0x00000000079DA000-memory.dmp
            Download

            memory/3692-26383-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/4000-6131-0x0000000005500000-0x0000000005B28000-memory.dmp
            Download

            memory/4000-26351-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/4304-26334-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download

            memory/4996-26421-0x0000000007360000-0x0000000007371000-memory.dmp
            Download

            memory/4996-26391-0x0000000071AD0000-0x0000000071B1C000-memory.dmp
            Download