dcrat | 5defd1c8d97e2bae79de123d81a28d49e2a42773a058420f35bf9d0a6b95c8be

Analysis

max time kernel
46s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample261026-bbdvjatxav
SHA256 5defd1c8d97e2bae79de123d81a28d49e2a42773a058420f35bf9d0a6b95c8be
MD5 34fc8ad251604ba21455617c9643b0e1
SHA1 a6f561e86709619ccf215f854c3599e62ec61c8d
SHA512 fd8cf613cd46fc63dc40f2da2680e80ea5af002b4859447c3e8b8b47871f5e734959638bd724eea9510ceb99ec553e376ce765a5117a86673c11ec699ab25f7e
SSDEEP 49152:8kQzAMIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc/:86UuRD9JdOR4m+lmY/4rx8c/
TLSH
T17E8523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellHost.exe\""	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellHost.exe\", \"C:\\Windows.old\\explorer.exe\""	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6012	988	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	988	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	988	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	988	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	988	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	988	schtasks.exe	89

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Custom signature

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/5900-5233-0x00000000064B0000-0x00000000064C0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5900-5237-0x0000000006580000-0x000000000658A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5900-5242-0x0000000006E90000-0x0000000006E9C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5900-5243-0x0000000007250000-0x000000000725A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5900-5245-0x0000000007270000-0x000000000727C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.exe
1888	powershell.exe
4492	powershell.exe
5016	powershell.exe
2420	powershell.exe
4716	powershell.exe
824	powershell.exe
1292	powershell.exe
5960	powershell.exe
260	powershell.exe
4596	powershell.exe
3212	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1528	ShellHost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ShellHost = "\"C:\\Recovery\\WindowsRE\\ShellHost.exe\""	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows.old\\explorer.exe\""	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows.old\\explorer.exe\""	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellHost = "\"C:\\Recovery\\WindowsRE\\ShellHost.exe\""	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
4720	WScript.exe
244	WScript.exe
6968	WScript.exe
5448	WScript.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5900-5233-0x00000000064B0000-0x00000000064C0000-memory.dmp	SmartAssembly
behavioral2/memory/5900-5237-0x0000000006580000-0x000000000658A000-memory.dmp	SmartAssembly
behavioral2/memory/5900-5242-0x0000000006E90000-0x0000000006E9C000-memory.dmp	SmartAssembly
behavioral2/memory/5900-5243-0x0000000007250000-0x000000000725A000-memory.dmp	SmartAssembly
behavioral2/memory/5900-5245-0x0000000007270000-0x000000000727C000-memory.dmp	SmartAssembly

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3756	schtasks.exe
3332	schtasks.exe
3532	schtasks.exe
6012	schtasks.exe
3528	schtasks.exe
2704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	1528	ShellHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 3212	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	101
PID 5900 wrote to memory of 824	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	102
PID 5900 wrote to memory of 4716	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	103
PID 5900 wrote to memory of 4596	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	104
PID 5900 wrote to memory of 2420	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	105
PID 5900 wrote to memory of 260	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	106
PID 5900 wrote to memory of 5016	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	107
PID 5900 wrote to memory of 4492	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	108
PID 5900 wrote to memory of 5960	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	109
PID 5900 wrote to memory of 1888	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	110
PID 5900 wrote to memory of 1292	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	111
PID 5900 wrote to memory of 2244	5900	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	112

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-24_34fc8ad251604ba21455617c9643b0e1_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:3212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:4716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:4596
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:2420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:5016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:4492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:5960
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:2244
- C:\Recovery\WindowsRE\ShellHost.exe
  "C:\Recovery\WindowsRE\ShellHost.exe"
  2⤵
  PID:924
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9acfdb5c-1ef0-467e-bfbb-409ce9c1d41f.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:244
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f72a3e95-2d8b-4d76-88d9-3a6ac3a72fef.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:6968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\ShellHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows.old\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows.old\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows.old\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Recovery\WindowsRE\ShellHost.exe
"C:\Recovery\WindowsRE\ShellHost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows.old\explorer.exe
"C:\Windows.old\explorer.exe"
1⤵
PID:5432
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4df02093-77bf-4201-bc2a-47ee2c85310d.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5448
- - C:\Windows.old\explorer.exe
    C:\Windows.old\explorer.exe
    3⤵
    PID:7924
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1772d573-97e9-4856-82ba-e321f5739edd.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ShellHost.exe

Path C:\Recovery\WindowsRE\ShellHost.exe
Size 1.7MB
SHA256 5defd1c8d97e2bae79de123d81a28d49e2a42773a058420f35bf9d0a6b95c8be
MD5 34fc8ad251604ba21455617c9643b0e1
SHA1 a6f561e86709619ccf215f854c3599e62ec61c8d
SHA512 fd8cf613cd46fc63dc40f2da2680e80ea5af002b4859447c3e8b8b47871f5e734959638bd724eea9510ceb99ec553e376ce765a5117a86673c11ec699ab25f7e
SSDEEP 49152:8kQzAMIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc/:86UuRD9JdOR4m+lmY/4rx8c/
TLSH
T17E8523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 bd8ec1f5bd762b1adec39de501d1fd788447ff9743e6a39b73e4358c26b686ad
MD5 85a2b50987403e97ffca46f2d94af898
SHA1 cc16f0fb0fddc71d01dfee57c90fdb7b6bdccffe
SHA512 8cb9137ac2b4d3a6860315da2be3bfa8b09338b5048d9405bb0956b3b358441f751fd6c2b5b447a95d63718391198f7e4db11e9db7dabdd4ad66fcbff03d3675
SSDEEP 1536:EtdKYo2hqHMBfKQVGflJdCHYyh4iUxPR40i71YiyyPUOdBcV3CNBQkj2Ya5eDjI2:EvKYo2hqHMBfKQVGflJdwYyqiUPRCqpA
TLSH
T1345373D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1772d573-97e9-4856-82ba-e321f5739edd.vbs

Path C:\Users\Admin\AppData\Local\Temp\1772d573-97e9-4856-82ba-e321f5739edd.vbs
Size 479B
SHA256 1ab03dd39fe609739193e105fb403362d603b59062715230ce16f5d6d130dcf8
MD5 b63bbda5ed6505d206f7243f4b22cd20
SHA1 57814a2d69e915f7390e83e0923ac24708c168e9
SHA512 80070fdad678a65438c5c4361975298d0081467963a6e4784b37aacba7ae63fdc92bdd06c6676934d89d47513d23aa98c6eba8d06dd9bdd97f027a36e50fc31d
TLSH
T1FCF0DC0CFF06C374C812034302FA48CF8AAC804D3A38D65DB908D8DE325123549EA1CE
MD5 SHA1 SHA512 TLSH

Submit Download

4df02093-77bf-4201-bc2a-47ee2c85310d.vbs

Path C:\Users\Admin\AppData\Local\Temp\4df02093-77bf-4201-bc2a-47ee2c85310d.vbs
Size 703B
SHA256 33131f3fb3894b43d0d70ee48c44810a809dbefe31f9cac99e182092de16fac9
MD5 0a4c62ccb2426c169170448bcb16d89f
SHA1 e2badbc39378eb6310b02da15a485d7898d2ee8e
SHA512 b93e62a61a7a84fdbbc2feac49bfaab33eb3115abdf52f79f381a86e57a8d4d67052fa7ebedb782d3beea65716d2681d309de815e949727d83b3b869e53aabd2
TLSH
T1E701CB06BE0FE67020A5234090FA45BB6AD880683136FD5BB960E46C2706A2404AC4EE
MD5 SHA1 SHA512 TLSH

Submit Download

9acfdb5c-1ef0-467e-bfbb-409ce9c1d41f.vbs

Path C:\Users\Admin\AppData\Local\Temp\9acfdb5c-1ef0-467e-bfbb-409ce9c1d41f.vbs
Size 710B
SHA256 be28a945db1d4fda5ee0543119cf1a4d0bfc5c73627c84b37160d4f188a42f18
MD5 ac4efdd248a2c83ca195e8c48fda5c96
SHA1 670c171a7fa6519ed2e6ef0d20b3a87ebdee8d22
SHA512 6fd90e820b35f4d1d2fb1b73a73c8734c15aa2ccf7146f248c1b7585fc1c252500f7c3a73e8870b19660b47dcec8ebf3b2a63a031f3e21271c4fd7a25b3aff25
TLSH
T16D01CB06BE0BE63060B52340D0FA45BF6ED880592136BC9BB950E4AC2706A2404AC8EE
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vgrrrr1j.5hp.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vgrrrr1j.5hp.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f72a3e95-2d8b-4d76-88d9-3a6ac3a72fef.vbs

Path C:\Users\Admin\AppData\Local\Temp\f72a3e95-2d8b-4d76-88d9-3a6ac3a72fef.vbs
Size 487B
SHA256 6efdb3f3b3ec23183b6976f7b34eb80aa0a982406e4c7962f053e5bec6886cf5
MD5 8718ef8a806e1b261297e4f1d545e2e2
SHA1 898faf4a7a421266f72d219e325e83f212f3a11a
SHA512 c975a75cc3044066df583676e619ab2362b04616e12d3d6ffc6133cb3ea8433b9c41e0dc1af53dcd975d9116ff38def6ab3c62d3770d32df1cc4ba70ab18bb4c
TLSH
T1F2F0970DBF05C734C821434342FA898F8AAC804E3638D65E6908D8DD329113549EB1CD
MD5 SHA1 SHA512 TLSH

Submit Download

explorer.exe

Path C:\Windows.old\explorer.exe
Size 1.7MB
SHA256 1d2031a31ddf87f516feb89908e19acaf6f9a735b9b0a0340dfdea7048d3537a
MD5 aa5e6d0f9270d05d09c08521d1830cb7
SHA1 de4082e3af19bc85b060f777b4a074604c2228ea
SHA512 81fbb2cc342e54e967b7a6eabab66fbc6c9c02508dfc6441113f2e76cb8d10b0096d9a1567def18ebdda4982a1e352bb97bf0ada0d48cead23000fa38394059a
SSDEEP 49152:IkQzA3IwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc2:I6tuRD9JdOR4m+lmY/4rx8c2
TLSH
T1FE8523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-18538-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/824-18317-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/1292-18605-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/1888-18686-0x0000000008010000-0x000000000868C000-memory.dmp

Download

memory/1888-13519-0x00000000066D0000-0x000000000671C000-memory.dmp

Download

memory/1888-8083-0x0000000005830000-0x0000000005896000-memory.dmp

Download

memory/1888-8082-0x0000000005710000-0x0000000005732000-memory.dmp

Download

memory/1888-13421-0x00000000065E0000-0x00000000065FE000-memory.dmp

Download

memory/1888-18298-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/2244-18526-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/2420-10286-0x0000000006380000-0x00000000066DB000-memory.dmp

Download

memory/2420-18363-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/3212-18295-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/3212-18267-0x0000000006190000-0x00000000061C6000-memory.dmp

Download

memory/3212-18687-0x0000000006FD0000-0x0000000006FEA000-memory.dmp

Download

memory/3212-18364-0x0000000006E90000-0x0000000006F33000-memory.dmp

Download

memory/3212-18965-0x0000000007040000-0x000000000704A000-memory.dmp

Download

memory/3212-18308-0x00000000060F0000-0x0000000006110000-memory.dmp

Download

memory/4492-18299-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/4492-19189-0x0000000007670000-0x0000000007706000-memory.dmp

Download

memory/4596-18659-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/4716-18456-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/5016-18446-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/5900-16-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-5237-0x0000000006580000-0x000000000658A000-memory.dmp

Download

memory/5900-90-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-82-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-80-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-78-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-77-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-74-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-72-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-70-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-68-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-66-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-64-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-60-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-58-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-54-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-87-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-88-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-62-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-50-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-48-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-46-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-45-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-40-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-38-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-36-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-35-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-32-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-28-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-26-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-24-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-23-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-20-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-18-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-0-0x00000000743B2000-0x00000000743B3000-memory.dmp

Download

memory/5900-14-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-7-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-12-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-10-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-1396-0x00000000743B2000-0x00000000743B3000-memory.dmp

Download

memory/5900-1397-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/5900-5229-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/5900-5230-0x00000000029E0000-0x00000000029FC000-memory.dmp

Download

memory/5900-5231-0x0000000002A10000-0x0000000002A60000-memory.dmp

Download

memory/5900-5233-0x00000000064B0000-0x00000000064C0000-memory.dmp

Download

memory/5900-5232-0x0000000002A70000-0x0000000002A78000-memory.dmp

Download

memory/5900-5235-0x00000000064F0000-0x00000000064F8000-memory.dmp

Download

memory/5900-5236-0x0000000006530000-0x0000000006540000-memory.dmp

Download

memory/5900-5234-0x0000000006510000-0x0000000006526000-memory.dmp

Download

memory/5900-92-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-5238-0x00000000068B0000-0x00000000068BC000-memory.dmp

Download

memory/5900-5239-0x00000000068C0000-0x00000000068D2000-memory.dmp

Download

memory/5900-5240-0x00000000068F0000-0x0000000006E1C000-memory.dmp

Download

memory/5900-5241-0x0000000006E80000-0x0000000006E8C000-memory.dmp

Download

memory/5900-5242-0x0000000006E90000-0x0000000006E9C000-memory.dmp

Download

memory/5900-5243-0x0000000007250000-0x000000000725A000-memory.dmp

Download

memory/5900-5245-0x0000000007270000-0x000000000727C000-memory.dmp

Download

memory/5900-5244-0x0000000007260000-0x0000000007268000-memory.dmp

Download

memory/5900-5250-0x0000000007380000-0x00000000073E6000-memory.dmp

Download

memory/5900-5248-0x0000000007360000-0x000000000736C000-memory.dmp

Download

memory/5900-5247-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/5900-5246-0x0000000007280000-0x0000000007312000-memory.dmp

Download

memory/5900-94-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-96-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-1-0x0000000005640000-0x00000000058BC000-memory.dmp

Download

memory/5900-2-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/5900-6793-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/5900-7400-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/5900-98-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-100-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-102-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-104-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-106-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-108-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-15146-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/5900-110-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-112-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-114-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-118-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-120-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-122-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-124-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-126-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-128-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-130-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-132-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-116-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-3-0x00000000058C0000-0x0000000005E7A000-memory.dmp

Download

memory/5900-84-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-56-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-52-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-42-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-30-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-8-0x00000000053C0000-0x0000000005634000-memory.dmp

Download

memory/5900-6-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/5900-5-0x00000000053C0000-0x000000000563A000-memory.dmp

Download

memory/5900-4-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/5960-18481-0x000000006F090000-0x000000006F0DC000-memory.dmp

Download

memory/5960-6574-0x00000000059B0000-0x0000000005FFA000-memory.dmp

Download

memory/5960-6565-0x0000000005220000-0x0000000005256000-memory.dmp

Download