dcrat | 68674b480b2430fe7493e62270d599ff043b0b75fbdfda601fe29c48456d5f18

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample261021-wt9edaex4w
SHA256 68674b480b2430fe7493e62270d599ff043b0b75fbdfda601fe29c48456d5f18
MD5 cb2aff3a5fed464f52ec7089bc5ea1e3
SHA1 c2a7e8d8f370f5af3f3315438e9aed03721b1569
SHA512 53a8790ab671df9b8e81399cc7695c6fd1741e093ae80704b1f7b292a04bf2e03c79083677e1c75e3e03aea16eb0cb98d5576bfc651beaf15ddb0f88ce816fe2
SSDEEP 49152:ckQzAzIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scJ:c6JuRD9JdOR4m+lmY/4rx8cJ
TLSH
T1EC8523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\smartscreen.exe\""	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Users\\Default\\My Documents\\ShellHost.exe\""	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Users\\Default\\My Documents\\ShellHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\RuntimeBroker.exe\""	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	1376	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	1376	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	1376	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5368	1376	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5748	1376	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	1376	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	1376	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5640	1376	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	1376	schtasks.exe	90

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/3488-5233-0x0000000006600000-0x0000000006610000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3488-5237-0x00000000066D0000-0x00000000066DA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3488-5242-0x0000000006FE0000-0x0000000006FEC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3488-5245-0x00000000073C0000-0x00000000073CC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3488-5243-0x00000000073A0000-0x00000000073AA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2152	powershell.exe
5896	powershell.exe
864	powershell.exe
4524	powershell.exe
3716	powershell.exe
5100	powershell.exe
1128	powershell.exe
5632	powershell.exe
5264	powershell.exe
2520	powershell.exe
1852	powershell.exe
2776	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4680	smartscreen.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smartscreen = "\"C:\\Recovery\\WindowsRE\\smartscreen.exe\""	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellHost = "\"C:\\Users\\Default\\My Documents\\ShellHost.exe\""	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ShellHost = "\"C:\\Users\\Default\\My Documents\\ShellHost.exe\""	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Mozilla Firefox\\RuntimeBroker.exe\""	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Mozilla Firefox\\RuntimeBroker.exe\""	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\smartscreen = "\"C:\\Recovery\\WindowsRE\\smartscreen.exe\""	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
5716	WScript.exe
6740	WScript.exe
6904	WScript.exe
6512	WScript.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/3488-5233-0x0000000006600000-0x0000000006610000-memory.dmp	SmartAssembly
behavioral2/memory/3488-5237-0x00000000066D0000-0x00000000066DA000-memory.dmp	SmartAssembly
behavioral2/memory/3488-5242-0x0000000006FE0000-0x0000000006FEC000-memory.dmp	SmartAssembly
behavioral2/memory/3488-5245-0x00000000073C0000-0x00000000073CC000-memory.dmp	SmartAssembly
behavioral2/memory/3488-5243-0x00000000073A0000-0x00000000073AA000-memory.dmp	SmartAssembly

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\RCXD399.tmp	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RuntimeBroker.exe	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Mozilla Firefox\RuntimeBroker.exe	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Mozilla Firefox\9e8d7a4ca61bd9	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXD118.tmp	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1088	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smartscreen.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2872	schtasks.exe
4396	schtasks.exe
5368	schtasks.exe
5748	schtasks.exe
1396	schtasks.exe
5640	schtasks.exe
5060	schtasks.exe
1848	schtasks.exe
4908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4680	smartscreen.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 5264	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	107
PID 3488 wrote to memory of 5632	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	108
PID 3488 wrote to memory of 1128	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	109
PID 3488 wrote to memory of 5100	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	110
PID 3488 wrote to memory of 864	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	111
PID 3488 wrote to memory of 5896	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	112
PID 3488 wrote to memory of 2152	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	113
PID 3488 wrote to memory of 2776	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	114
PID 3488 wrote to memory of 1852	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	115
PID 3488 wrote to memory of 3716	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	116
PID 3488 wrote to memory of 2520	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	117
PID 3488 wrote to memory of 4524	3488	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	118

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-20_cb2aff3a5fed464f52ec7089bc5ea1e3_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5264
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1128
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BdOqTAMfts.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1088
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:6920
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:5820
- - C:\Recovery\WindowsRE\smartscreen.exe
    "C:\Recovery\WindowsRE\smartscreen.exe"
    3⤵
    PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smartscreen.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\My Documents\ShellHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHost" /sc ONLOGON /tr "'C:\Users\Default\My Documents\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\My Documents\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Recovery\WindowsRE\smartscreen.exe
"C:\Recovery\WindowsRE\smartscreen.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4680
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df9df2c3-50db-42a8-a03e-ee6009bb5a5e.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5716
- - C:\Recovery\WindowsRE\smartscreen.exe
    C:\Recovery\WindowsRE\smartscreen.exe
    3⤵
    PID:4160
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91efdebb-f7e2-43cd-8d3b-e632950b472b.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6740

C:\Program Files\Mozilla Firefox\RuntimeBroker.exe
"C:\Program Files\Mozilla Firefox\RuntimeBroker.exe"
1⤵
PID:5492
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8fb83066-f654-4166-bef6-1329b557d352.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6904
- - C:\Program Files\Mozilla Firefox\RuntimeBroker.exe
    "C:\Program Files\Mozilla Firefox\RuntimeBroker.exe"
    3⤵
    PID:6308
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb0ddc78-eca0-4c33-a09e-5f4bbc1ecc2c.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6512

C:\Users\Default\My Documents\ShellHost.exe
"C:\Users\Default\My Documents\ShellHost.exe"
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Program Files\Mozilla Firefox\RuntimeBroker.exe
Size 1.7MB
SHA256 be751c13922ffaea4d498aa5f36655b8c29a490f10c75d6f69562015cc93233e
MD5 c8b03dba83bd21032e5deda3f5f87864
SHA1 42abc20ddce8355809f55f3eb6d5b3e77fa965d4
SHA512 cdc62cbd2b0cd5af521e6cee6b977c6f9d5f643d15d42bdaf37e60c24b5d93ab9fcc748d79e883af852b8afaee1745c258333d6455d9814bd435bc975dd29def
SSDEEP 49152:ckQzAYIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scE:c6wuRD9JdOR4m+lmY/4rx8cE
TLSH
T1938523097181D333C2FB003085C58FB55A2566264F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smartscreen.exe

Path C:\Recovery\WindowsRE\smartscreen.exe
Size 1.7MB
SHA256 68674b480b2430fe7493e62270d599ff043b0b75fbdfda601fe29c48456d5f18
MD5 cb2aff3a5fed464f52ec7089bc5ea1e3
SHA1 c2a7e8d8f370f5af3f3315438e9aed03721b1569
SHA512 53a8790ab671df9b8e81399cc7695c6fd1741e093ae80704b1f7b292a04bf2e03c79083677e1c75e3e03aea16eb0cb98d5576bfc651beaf15ddb0f88ce816fe2
SSDEEP 49152:ckQzAzIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scJ:c6JuRD9JdOR4m+lmY/4rx8cJ
TLSH
T1EC8523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 8516c097074286ed23a6581eba35fbab61df7ab886364add7cdd5dd9cd0a7369
MD5 98e0ef14b93564a45065ab220b9add63
SHA1 234b499279efe0fa997159be2680f98911f06de2
SHA512 9b68ac5eec5dd5af3e4b6964ffdcbb55c297eda625e5f9ba250d9af9d335e3bbfe98be8a6d92dad098d40412695afa6e1329198dd1e5643297b86545224f78ad
SSDEEP 1536:4td5Yo2hO3vdfKQVrflJdCHYWh4iUx9R40i71YidyPcMrxoV3CNBQkj2Ya5eDjIj:4v5Yo2hO3vdfKQVrflJdwYWqiU9RCqe9
TLSH
T1E55374D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 624e5cc79c1dea93c8110ab28c9bf12cde9d712010618fb275fc6bef8e44c8a7
MD5 cff1be9d57ce2a215187b644d9f37848
SHA1 60de2cad47a3283a03c4f34a407bff2e8f72dd02
SHA512 41b7e174ab649378af044b83b73288f0271e1fac52eaef13e304344c560e6be11efc7fe8ef42105c65e6dc026fe8742a8726c9fb0c7925b7c8d93b07e94da391
SSDEEP 1536:ctd5Yo2hO3vdfKQVrflJdCHY+iFHzwqR40i71YidyPcMrx+i3jiRjdvRwa5GDjIj:cv5Yo2hO3vdfKQVrflJdwYPFHzHRCqeD
TLSH
T12D5374D2E9204E75E1A66F3EF15622627C34394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 bc13df42b26603e46e9855edf6b8119be3753b65e3fdd3cda34428d56d702605
MD5 b7fe53dda4ad20ff606d2bf3551d567a
SHA1 eec61d871e1be3b84927f405c66e167d14cba388
SHA512 839446365a26a8d360285f462f9045673fdc788e8e4f2646ac97b6acdb3ef9567fbdc47c6fcfaa107bceb928241c9a6c90feed306f26df33373a7356d3a4ef81
SSDEEP 1536:4td5Cw2hq3vdfKQVrflJdCHYWh4iUx9R40i71YidyPcMrxoV3CNBQkj2Ya5eDjIj:4v5Cw2hq3vdfKQVrflJdwYWqiU9RCqe9
TLSH
T1EF5374D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 a0cb58f55b6b0fc4ee8d8b209511c8bfad2956a6bb0d69b401c33c68f39af901
MD5 a43df3c7a39ec73e3e10e1e865b334b4
SHA1 7eb14eb34d17f8695ce9d73b60580a2e631ae8a8
SHA512 020e95ebee0a0807aacef2c68deef88d47547a5c94e485ad0e99848b1801eb02823556edc25f64ce8f46ba97250392516e67fec9a3d70a8498645d01c7743096
SSDEEP 1536:4td5Yo2hq3vdfKQVrflJdCHYWh4iUx9R40i71YidyPcMrxoV3CNBQkj2Ya5eDjIj:4v5Yo2hq3vdfKQVrflJdwYWqiU9RCqe9
TLSH
T18A5374D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fb83066-f654-4166-bef6-1329b557d352.vbs

Path C:\Users\Admin\AppData\Local\Temp\8fb83066-f654-4166-bef6-1329b557d352.vbs
Size 726B
SHA256 7eb2baaf5eb5a02b46635253f9c98e9bcdf2fd677239ad1aa1959b8c21dce5d7
MD5 7712a3c5073a339e5e8b4f23068f8911
SHA1 6cf88899feba5819be5d5ac9fd96449bc1858f2b
SHA512 a01421c0ae48787223c4fd3ae3f95854de8e3971afa0c439233db3f900ab1e2ef09b17beac03b71c9a4df9af3a764494de7c76de49f78917f8905322151e6cae
TLSH
T1AB01DC06BE0BE67024A12340A1FA54BB5AD880182236B847BA60E46C221AE2000AC4ED
MD5 SHA1 SHA512 TLSH

Submit Download

91efdebb-f7e2-43cd-8d3b-e632950b472b.vbs

Path C:\Users\Admin\AppData\Local\Temp\91efdebb-f7e2-43cd-8d3b-e632950b472b.vbs
Size 489B
SHA256 1c7c0d08617d760cf1b4665d888cd5699b4efd826f71050603ef429cf5a3a4da
MD5 706c8080b7fd2f90e296166081988525
SHA1 6952f5bbdeb95513212ebe2701e09033780eb932
SHA512 49d223d04f7d58c6ee8e62b4d2bcb26df33f0d3f2e7e4e1fcb9e6be0c39993b3cccde4a8b019add51899a98702b38aec917e4e3e350504531d3c375265ae13df
TLSH
T1D5F0970DBF06C774C821034342FA898F8AAC808A3638E65E6908D8ED329163549EA0CD
MD5 SHA1 SHA512 TLSH

Submit Download

BdOqTAMfts.bat

Path C:\Users\Admin\AppData\Local\Temp\BdOqTAMfts.bat
Size 202B
SHA256 823c839a7e12bd1b3b9c5c7822e33cb57d80d033ca7835aadc810245234d5525
MD5 6c9d2a13b4675da76ecb628cab7ede0d
SHA1 1b0a89d2e94f114b08a7a4f894a92f4e5772a9dc
SHA512 6a7d510dec672fe2b5e3bd7068d22f952c7b61ecdb675a18701a3d0bc58e42b422457d60da1c2a9c85929efbcebe6af4904bbf82634f7c48770888b440317e0e
TLSH
T1DAD0C083A012CF8404A60E078C4F13CE663328CEB2C93B300A8708BC6E8B477B54F1C2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zu3wqugi.u3c.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zu3wqugi.u3c.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

df9df2c3-50db-42a8-a03e-ee6009bb5a5e.vbs

Path C:\Users\Admin\AppData\Local\Temp\df9df2c3-50db-42a8-a03e-ee6009bb5a5e.vbs
Size 713B
SHA256 2b51df798e34a7c5a2da7eb1c6613674ba87d58e0eec2feaac384577aae7bf9b
MD5 e49a6b4353f4baff8ca65ad98662ecf8
SHA1 70e830b53d53a34735d9232e0d78ba7e531bb68c
SHA512 a55831e965cafad19e7dc49a44364ff3313a593e0177aaa1ad33200e8976c2a6c1a1aec0afbd9ec7871f7fd1df2a50b52abc085353b89c5944f9a46d1613cd7a
TLSH
T14D01CB16BE0FE67060F1274090FA45BF6ED880582136B99BB950E4AC2706E2404AC4EE
MD5 SHA1 SHA512 TLSH

Submit Download

fb0ddc78-eca0-4c33-a09e-5f4bbc1ecc2c.vbs

Path C:\Users\Admin\AppData\Local\Temp\fb0ddc78-eca0-4c33-a09e-5f4bbc1ecc2c.vbs
Size 502B
SHA256 ccf844543ff4d369f445c535d80ae23c1d425e687f4f464ba49de105d415588a
MD5 fb7112a5bbd8bfedb2ce82fbc5ff8417
SHA1 07cfb636f619a32358d7223886fc1f284ed94f82
SHA512 5dbbbdeb7be279e5964b9aad90675436a3dd1728fba23e7ae06cb363b07de4c0fdcece0b6c9837c90ced5b9f72b0cd6388f905e2dcc760bd984b50700409a813
TLSH
T1E5F0590DAF06C3788812034213FA58CF8AAC844D3638D6596608D89E315167449FE5CD
MD5 SHA1 SHA512 TLSH

Submit Download

ShellHost.exe

Path C:\Users\Default\Documents\ShellHost.exe
Size 1.7MB
SHA256 ae5e23ea7da31df7e8597239b9609d09c61f2e7b26116387acf3e9c72de3d334
MD5 cdced61d0450a67a892b3e556ad41f33
SHA1 9333cf38c0cefa8818b96519d152fa61fbc8ea19
SHA512 857e64446a2a7ffa446f42b5fffd38af752f70421ebf933127b2b1c7511a258f6e16f2c7e33c9806bbcb23507c536c8510c366068f05e9eb4f364807a49b7704
SSDEEP 49152:8kQzAbIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scn:86xuRD9JdOR4m+lmY/4rx8cn
TLSH
T1B68523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/864-21538-0x000000006F3D0000-0x000000006F41C000-memory.dmp

Download

memory/864-11187-0x0000000006300000-0x000000000665B000-memory.dmp

Download

memory/1128-6904-0x0000000005040000-0x000000000568A000-memory.dmp

Download

memory/1852-6902-0x0000000005420000-0x0000000005456000-memory.dmp

Download

memory/1852-9085-0x00000000061C0000-0x0000000006226000-memory.dmp

Download

memory/1852-8898-0x0000000005AC0000-0x0000000005AE2000-memory.dmp

Download

memory/2520-14227-0x0000000006760000-0x00000000067AC000-memory.dmp

Download

memory/2520-14066-0x0000000005510000-0x000000000552E000-memory.dmp

Download

memory/3488-126-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-82-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-58-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-56-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-52-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-51-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-48-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-46-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-44-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-42-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-38-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-36-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-32-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-30-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-28-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-23-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-21-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-19-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-18-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-16-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-13-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-9-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-7-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-25-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-6-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-80-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-84-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-86-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-94-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-98-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-96-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-104-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-112-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-122-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-124-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-132-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-130-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-128-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-64-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-120-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-118-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-116-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-115-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-110-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-108-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-106-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-102-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-100-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-92-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-90-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-88-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-62-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-76-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-78-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-1649-0x0000000074242000-0x0000000074243000-memory.dmp

Download

memory/3488-1650-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-5229-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-5230-0x0000000002BB0000-0x0000000002BCC000-memory.dmp

Download

memory/3488-5231-0x0000000002BE0000-0x0000000002C30000-memory.dmp

Download

memory/3488-5232-0x0000000002C40000-0x0000000002C48000-memory.dmp

Download

memory/3488-5234-0x0000000006660000-0x0000000006676000-memory.dmp

Download

memory/3488-5233-0x0000000006600000-0x0000000006610000-memory.dmp

Download

memory/3488-5235-0x0000000006640000-0x0000000006648000-memory.dmp

Download

memory/3488-5236-0x0000000006680000-0x0000000006690000-memory.dmp

Download

memory/3488-5237-0x00000000066D0000-0x00000000066DA000-memory.dmp

Download

memory/3488-5238-0x0000000006A00000-0x0000000006A0C000-memory.dmp

Download

memory/3488-5239-0x0000000006A10000-0x0000000006A22000-memory.dmp

Download

memory/3488-5240-0x0000000006A40000-0x0000000006F6C000-memory.dmp

Download

memory/3488-5241-0x0000000006FD0000-0x0000000006FDC000-memory.dmp

Download

memory/3488-5242-0x0000000006FE0000-0x0000000006FEC000-memory.dmp

Download

memory/3488-5245-0x00000000073C0000-0x00000000073CC000-memory.dmp

Download

memory/3488-5244-0x00000000073B0000-0x00000000073B8000-memory.dmp

Download

memory/3488-5243-0x00000000073A0000-0x00000000073AA000-memory.dmp

Download

memory/3488-5246-0x00000000073D0000-0x0000000007462000-memory.dmp

Download

memory/3488-5248-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-5247-0x00000000074B0000-0x00000000074BC000-memory.dmp

Download

memory/3488-5249-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-5251-0x0000000007620000-0x0000000007686000-memory.dmp

Download

memory/3488-6654-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-7056-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-7463-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-66-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-68-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-70-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-72-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-74-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-13555-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-60-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-54-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-40-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-34-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-26-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-11-0x0000000005340000-0x00000000055B4000-memory.dmp

Download

memory/3488-5-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-4-0x0000000005340000-0x00000000055BA000-memory.dmp

Download

memory/3488-3-0x0000000005850000-0x0000000005E0A000-memory.dmp

Download

memory/3488-0-0x0000000074242000-0x0000000074243000-memory.dmp

Download

memory/3488-2-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/3488-1-0x00000000055D0000-0x000000000584C000-memory.dmp

Download

memory/5264-21539-0x000000006F3D0000-0x000000006F41C000-memory.dmp

Download

memory/5264-21353-0x0000000002C10000-0x0000000002C46000-memory.dmp

Download