Overview

overview

10

Static

static

3

2026-11-09...ee.exe

windows10-2004-x64

10

2026-11-09...ee.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    102s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/11/2026, 00:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_2ab46433165f941b9bac2f99f0c0e103_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
  • Size 1.7MB
  • Sample261111-ad7d7ady7v
  • SHA256 f2e03f96c1313268b5ff1c7608dba97404adeca0628196a392423330d3ce6a99
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutiondcratinfostealerpersistencerattrojan

Malware Config

Signatures

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Custom signature
    Detects executables packed with SmartAssembly 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 1 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs
    execution
  • SmartAssembly .NET packer 5 IoCs

    Detects SmartAssembly .NET packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 6 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_2ab46433165f941b9bac2f99f0c0e103_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_2ab46433165f941b9bac2f99f0c0e103_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4736
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1692
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2964
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2504
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2184
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3680
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3948
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4884
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4712
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4812
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1736
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:428
    • C:\Recovery\WindowsRE\RuntimeBroker.exe
      "C:\Recovery\WindowsRE\RuntimeBroker.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3744
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4988
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2148
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2328
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4892
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4552
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:5100
  • C:\Recovery\WindowsRE\RuntimeBroker.exe
    "C:\Recovery\WindowsRE\RuntimeBroker.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4540
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a4ad2f4-fbad-4b82-b73b-ecf68a8d0b92.vbs"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:5112
      • C:\Recovery\WindowsRE\RuntimeBroker.exe
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        3⤵
          PID:7240
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29cf4a54-a758-490e-a3cf-eed9b766b986.vbs"
            4⤵
            • Executes a VBScript file via the Windows Script Host.
            PID:5032
            • C:\Recovery\WindowsRE\RuntimeBroker.exe
              C:\Recovery\WindowsRE\RuntimeBroker.exe
              5⤵
                PID:3212
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdd11510-a15e-4314-9829-7ef4219a5c90.vbs"
              4⤵
              • Executes a VBScript file via the Windows Script Host.
              PID:3396
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3942a39d-37cc-4819-9e8f-abc0b8a67d57.vbs"
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:8168
      • C:\Recovery\WindowsRE\taskhostw.exe
        "C:\Recovery\WindowsRE\taskhostw.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3372

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            1
            T1562

            Disable or Modify Tools

            1
            T1562.001

            Modify Registry

            4
            T1112

            Credential Access

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            RuntimeBroker.exe
            • Path C:\Recovery\WindowsRE\RuntimeBroker.exe
            • Size 1.7MB
            • SHA256 f2e03f96c1313268b5ff1c7608dba97404adeca0628196a392423330d3ce6a99
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RuntimeBroker.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RuntimeBroker.exe.log
            • Size 942B
            • SHA256 c295416053705f71b5287254d10d37efcbce5a07deda8785b1e5fc0985eeb00c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 c1a9c82a91594b76c58af29417c66df71fd889a8ae71b4367c459b5fb8ba0594
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 904c0e94a304f429de07e55e915d18eac1c600c6fb9602e9b75c146bb867a7a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 cd6881e10b6fe08a15401d345023c56795436e974c56a5f761a36da889fd89d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 48eb02b51ea34a9d2d9580a3c701d44b92edeceaafed602743a5ab8e17d1d723
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 2052d15e43540e74672a48f1c7a349a0fa81c246ea4ea847a2cb5ba909687147
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 18KB
            • SHA256 b75790da009c281cd850dbfcbc89bf9e8ca246f1978cabdc9c382bed53670e6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 64B
            • SHA256 44a577b2cd448369ef22fb740c857ece88143587cc06fe53f549ee59eb55432f
            • MD5 SHA1 SHA512
            Submit Download

            29cf4a54-a758-490e-a3cf-eed9b766b986.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\29cf4a54-a758-490e-a3cf-eed9b766b986.vbs
            • Size 715B
            • SHA256 64ada49f410a761ce8bb699c103c174c54d6e43e97c4a95d7269e8848bea9e8d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            3942a39d-37cc-4819-9e8f-abc0b8a67d57.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\3942a39d-37cc-4819-9e8f-abc0b8a67d57.vbs
            • Size 491B
            • SHA256 4ed592d01e354ad21412c86c693b6268efa911b66b1e973167c4e9b8dc1a3520
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            5a4ad2f4-fbad-4b82-b73b-ecf68a8d0b92.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\5a4ad2f4-fbad-4b82-b73b-ecf68a8d0b92.vbs
            • Size 715B
            • SHA256 7e3585031a65869e8ddfb82b517343fcface86859a4dc2ab7fd3e8ca68e79fba
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RCX797D.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RCX797D.tmp
            • Size 1.7MB
            • SHA256 511b4a18b57085f002bad2958b6eca4da9f4390143673cb0b11049adfc1dba09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_yodwcu4d.p1p.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yodwcu4d.p1p.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/428-21070-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/428-21124-0x0000000007070000-0x0000000007106000-memory.dmp
            Download

            memory/428-17619-0x0000000005FB0000-0x0000000005FFC000-memory.dmp
            Download

            memory/428-21121-0x0000000007450000-0x0000000007ACA000-memory.dmp
            Download

            memory/428-21122-0x0000000006DF0000-0x0000000006E0A000-memory.dmp
            Download

            memory/428-17437-0x0000000004A90000-0x0000000004AAE000-memory.dmp
            Download

            memory/1692-6266-0x0000000002AF0000-0x0000000002B26000-memory.dmp
            Download

            memory/1692-21080-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/1692-6310-0x00000000055E0000-0x0000000005C08000-memory.dmp
            Download

            memory/1692-21127-0x0000000007970000-0x0000000007984000-memory.dmp
            Download

            memory/1736-21046-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/1736-21128-0x0000000007C40000-0x0000000007C5A000-memory.dmp
            Download

            memory/2184-21029-0x0000000006D30000-0x0000000006D62000-memory.dmp
            Download

            memory/2184-21079-0x0000000007000000-0x00000000070A3000-memory.dmp
            Download

            memory/2184-21078-0x0000000006DD0000-0x0000000006DEE000-memory.dmp
            Download

            memory/2184-21030-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/2504-21088-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/2504-21126-0x0000000007D60000-0x0000000007D6E000-memory.dmp
            Download

            memory/2964-21054-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/3680-21113-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/3680-7686-0x0000000005700000-0x0000000005722000-memory.dmp
            Download

            memory/3680-7687-0x00000000057A0000-0x0000000005806000-memory.dmp
            Download

            memory/3948-21104-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/4712-21096-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/4712-21125-0x0000000007D10000-0x0000000007D21000-memory.dmp
            Download

            memory/4736-44-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-5249-0x0000000007200000-0x0000000007266000-memory.dmp
            Download

            memory/4736-26-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-24-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-22-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-20-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-14-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-12-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-10-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-6-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-18-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-16-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-104-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-130-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-128-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-126-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-124-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-122-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-120-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-116-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-114-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-112-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-110-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-108-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-106-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-102-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-100-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-98-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-118-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-2453-0x0000000005110000-0x0000000005120000-memory.dmp
            Download

            memory/4736-2738-0x0000000005110000-0x0000000005120000-memory.dmp
            Download

            memory/4736-2919-0x0000000005110000-0x0000000005120000-memory.dmp
            Download

            memory/4736-5228-0x0000000005110000-0x0000000005120000-memory.dmp
            Download

            memory/4736-5229-0x0000000002840000-0x000000000285C000-memory.dmp
            Download

            memory/4736-5230-0x0000000002870000-0x00000000028C0000-memory.dmp
            Download

            memory/4736-5231-0x00000000028D0000-0x00000000028D8000-memory.dmp
            Download

            memory/4736-5232-0x0000000006210000-0x0000000006220000-memory.dmp
            Download

            memory/4736-5233-0x00000000062D0000-0x00000000062E6000-memory.dmp
            Download

            memory/4736-5234-0x0000000006250000-0x0000000006258000-memory.dmp
            Download

            memory/4736-5235-0x00000000062F0000-0x0000000006300000-memory.dmp
            Download

            memory/4736-5236-0x0000000006710000-0x000000000671A000-memory.dmp
            Download

            memory/4736-5237-0x0000000006740000-0x000000000674C000-memory.dmp
            Download

            memory/4736-5238-0x0000000006750000-0x0000000006762000-memory.dmp
            Download

            memory/4736-5239-0x0000000006860000-0x0000000006D8C000-memory.dmp
            Download

            memory/4736-5240-0x00000000067E0000-0x00000000067EC000-memory.dmp
            Download

            memory/4736-5244-0x0000000007020000-0x000000000702C000-memory.dmp
            Download

            memory/4736-5243-0x0000000007010000-0x0000000007018000-memory.dmp
            Download

            memory/4736-5246-0x00000000071E0000-0x00000000071EC000-memory.dmp
            Download

            memory/4736-5245-0x0000000007030000-0x00000000070C2000-memory.dmp
            Download

            memory/4736-30-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-5242-0x0000000006840000-0x000000000684A000-memory.dmp
            Download

            memory/4736-5241-0x00000000067F0000-0x00000000067FC000-memory.dmp
            Download

            memory/4736-5250-0x0000000005110000-0x0000000005120000-memory.dmp
            Download

            memory/4736-32-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-34-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-36-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-38-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-40-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-1-0x00000000053B0000-0x000000000562C000-memory.dmp
            Download

            memory/4736-42-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-0-0x0000000005110000-0x0000000005120000-memory.dmp
            Download

            memory/4736-58-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-62-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-46-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-48-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-50-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-2-0x0000000005110000-0x0000000005120000-memory.dmp
            Download

            memory/4736-52-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-54-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-56-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-60-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-64-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-70-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-72-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-74-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-76-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-78-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-80-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-3-0x0000000005630000-0x0000000005BD4000-memory.dmp
            Download

            memory/4736-83-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-84-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-4-0x0000000005120000-0x000000000539A000-memory.dmp
            Download

            memory/4736-86-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-88-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-90-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-94-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-96-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-5-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-92-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-68-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-66-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-28-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4736-8-0x0000000005120000-0x0000000005394000-memory.dmp
            Download

            memory/4812-21129-0x0000000007650000-0x0000000007658000-memory.dmp
            Download

            memory/4812-21123-0x00000000073A0000-0x00000000073AA000-memory.dmp
            Download

            memory/4812-21038-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download

            memory/4812-7782-0x0000000005B30000-0x0000000005E84000-memory.dmp
            Download

            memory/4884-21062-0x0000000070B90000-0x0000000070BDC000-memory.dmp
            Download