ramsay | e7b5d168225c9367d2c469884d3343a2e7cbe20232b8207e3362c645d60658ea

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/09/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1005KB
Sample260911-e6yd7sbp5z
SHA256 e7b5d168225c9367d2c469884d3343a2e7cbe20232b8207e3362c645d60658ea
MD5 6483685478e543b3ceff51ee81b2c6d1
SHA1 b2d04fe8136605e5190b73502908d9e4aa03d24d
SHA512 1a9b9fd6e9060780a2895614de5c56d45b28e3d40613814b3b8a2786e264e4babe36a0473a9e1b984d4c5c702f875fdf285b9d6d378fa32035b961b53e2a1d47
SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtxb8RAwF6E1ucV/7m:1hLoBdqTDtSQWGtF8L6HX
TLSH
T1BF25121171E48072F06351309AB9DB618B3EBD626BA4D0DF2B8858AF1E61BD1DF34367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/4920-206-0x0000000000B50000-0x0000000000CCA000-memory.dmp	family_ramsay_payload
behavioral1/memory/4920-214-0x0000000000B50000-0x0000000000CCA000-memory.dmp	family_ramsay_payload
behavioral1/files/0x000800000002462e-213.dat	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/4920-206-0x0000000000B50000-0x0000000000CCA000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/4920-214-0x0000000000B50000-0x0000000000CCA000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/4920-206-0x0000000000B50000-0x0000000000CCA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/4920-214-0x0000000000B50000-0x0000000000CCA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/4920-206-0x0000000000B50000-0x0000000000CCA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4920-214-0x0000000000B50000-0x0000000000CCA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x000200000002333c-13.dat	UPX
behavioral1/memory/4920-15-0x0000000000B50000-0x0000000000CCA000-memory.dmp	UPX
behavioral1/memory/4920-206-0x0000000000B50000-0x0000000000CCA000-memory.dmp	UPX
behavioral1/memory/4920-214-0x0000000000B50000-0x0000000000CCA000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	lxnfrmciip.exe

Executes dropped EXE 5 IoCs

pid	Process
6000	lxnfrmciip.exe
4920	gdvbxxvydm.exe
2328	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4892	update.exe
5728	bindsvc.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\n:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\u:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\w:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\a:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\o:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\p:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\q:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\t:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\v:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\x:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\m:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\r:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\s:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\z:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\h:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\j:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\k:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\y:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\b:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\e:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\g:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\i:	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wimsvc.exe	gdvbxxvydm.exe
File created	C:\Windows\SysWOW64\racfg.exe	gdvbxxvydm.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	gdvbxxvydm.exe
File created	C:\Windows\system32\msfte.dll	gdvbxxvydm.exe
File created	C:\Windows\system32\oci.dll	gdvbxxvydm.exe
File created	C:\Windows\System32\bindsvc.exe	gdvbxxvydm.exe
File created	C:\Windows\SysWOW64\wideshut.exe	gdvbxxvydm.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	gdvbxxvydm.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000200000002333c-13.dat	upx
behavioral1/memory/4920-15-0x0000000000B50000-0x0000000000CCA000-memory.dmp	upx
behavioral1/memory/4920-206-0x0000000000B50000-0x0000000000CCA000-memory.dmp	upx
behavioral1/memory/4920-214-0x0000000000B50000-0x0000000000CCA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1108	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdvbxxvydm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lxnfrmciip.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	update.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000153a65c0a641dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d624dc0a641dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cccd3bc1a641dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010af7ac0a641dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077d1dec0a641dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4920	gdvbxxvydm.exe
4920	gdvbxxvydm.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	848	SearchIndexer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 6000	4536	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	86
PID 4536 wrote to memory of 4920	4536	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 848 wrote to memory of 1392	848	SearchIndexer.exe	89
PID 848 wrote to memory of 6024	848	SearchIndexer.exe	90
PID 6000 wrote to memory of 2328	6000	lxnfrmciip.exe	91
PID 2328 wrote to memory of 4892	2328	2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	92
PID 4920 wrote to memory of 3804	4920	gdvbxxvydm.exe	103
PID 3804 wrote to memory of 1108	3804	cmd.exe	105
PID 4920 wrote to memory of 1184	4920	gdvbxxvydm.exe	106
PID 4920 wrote to memory of 5728	4920	gdvbxxvydm.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\lxnfrmciip.exe
  "C:\Users\Admin\AppData\Local\Temp\lxnfrmciip.exe" "C:\Users\Admin\AppData\Local\Temp\oxlibqjzcb.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Users\Admin\AppData\Local\Temp\2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-10_6483685478e543b3ceff51ee81b2c6d1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - \??\c:\bd158672b\update\update.exe
      c:\bd158672b\update\update.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      PID:4892
- C:\Users\Admin\AppData\Local\Temp\gdvbxxvydm.exe
  C:\Users\Admin\AppData\Local\Temp\gdvbxxvydm.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:1108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DDr5CrjX.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1184
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1392
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DDr5CrjX.bat

Path C:\Users\Admin\AppData\Local\Temp\DDr5CrjX.bat
Size 196B
SHA256 f78391f2ba120f15d3755c339768c9299abbd349400aefb176a31ba42244f6c1
MD5 1f03de2fc40ca45784426de06ec1ea29
SHA1 c38b891cc56c7dd197701f9377c0c26e552f171b
SHA512 e7f32d5608046a5c4951b67ff91f00ebf17b2ad036d0a1a48c78184de27e112d9027a42233d636b225a8c60096428d27221bbb91e8b3ed93e020deacf69971b4
TLSH
T114D0131193D7DE5E584DD16F067361CED1A14C5C3F4A37116650844971C650DF5C3301
MD5 SHA1 SHA512 TLSH

Submit Download

gdvbxxvydm.exe

Path C:\Users\Admin\AppData\Local\Temp\gdvbxxvydm.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lxnfrmciip.exe

Path C:\Users\Admin\AppData\Local\Temp\lxnfrmciip.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oxlibqjzcb.exe

Path C:\Users\Admin\AppData\Local\Temp\oxlibqjzcb.exe
Size 299KB
SHA256 98fee9d1e6d9762828f12509a459149420f516b5b7e00ff262fd1d1cfd8cabd3
MD5 69b7a0053dfbd75f5963621d28d37e4a
SHA1 0d9a92df6bf98357e65507e2a0fe15aae6f82ec1
SHA512 ffd22200e644fa48dce37242e3bc27922dbf382e80a9e80bc658f239fef54c5166b8252e5c78bb4b6d5a49cac0f4d4351dbe30237220168b0fc6b10f28f8b759
SSDEEP 6144:LNO8abtFhO+W58X3rFPtl6UiBgzwRT6Aa6TRsxcSczp1JX/sEJMVn3Sc:LU8agViTEURz+6AF1SpczpH/B6nic
TLSH
T12464230138ED609FD5B319B2F5F7BB516571B953B401FBAE0B98EC672400BC1EA352A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 6b03ee0eea12276a4ac67c79c22d3258857672f3298f6a4185642eccc2a62ba0
MD5 5eb59af4bbd9a4e858fac5f372260ad2
SHA1 d93fdde493955564bcd87477bc1342a02ad3c432
SHA512 4df2e79b78f70dc05caba339d449f7779343c5de03e0d96b9fb239ba26c671f2e3310f82d4d5e27aa6fef7f727d7e65a2369da097346bb9c8e5bc4ec2a35448c
TLSH
T1CA214F5E1B913E23C1394B66AFB4C5F7C997E00D6EC413428503B7A1C7635EE43185AD
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\bd158672b\update\update.exe
Size 264KB
SHA256 c69cb8191a0a5c46d795b10d6f466e850885c1e96cbdf61ef8f56fcda5f0adbb
MD5 af54c7086e42feef01e87c9fa9eb94d3
SHA1 86420da790c790865699a0d0265abfa2c53eef1f
SHA512 0bc0d8acc99f504ea3fbe7175645f7b3cd920b1186f49756f6cbcc84932da709e7dd8bceccc36ab10765b226e61d1eacc2031cbb5d2e15ef1414a9ac27a1cd82
SSDEEP 6144:zdpmXaTEupRXostAC29yKRj5I8uKEGg3gUGkoC7yYxO:zdppVAC29yKRj5I8uKjgQUeOs
TLSH
T1C344F61163E79839FCB227701AB242520BB5BDA02B35D7CFD7817A5D58B96C0AD39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.inf

Path \??\c:\bd158672b\update\update.inf
Size 32KB
SHA256 f051fe7e2d905a2c822d11f410eb5444ed4fbeb636bacdef2e8d15226e5ea0db
MD5 06f59f9107f157e549d5ababab8eceb6
SHA1 f3a06c8e94dbe4b54129d7aa9978b96314eac786
SHA512 e03c80fb43aa9a72640b9951158869fca34bc27a13cbb62bcdefcba937d64f661aac6b2afbf6c6ea66880cd21dd97990125002334c0e3f51f230b70f3aadbcfd
SSDEEP 768:2ysC/LJVOqVI4LvKTVnf3eJpzeElISjQ5ULKvAuQ3q90MKF:Tl/LJVbVI4mto5S0MKF
TLSH
T1A4E253A957070B61F1B03AA885D3CD9BF72046139051001E3ADEA7C6DFF618A83E99FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/848-21-0x000001B75C8A0000-0x000001B75C8B0000-memory.dmp

Download

memory/848-84-0x000001B766520000-0x000001B766528000-memory.dmp

Download

memory/848-53-0x000001B764E90000-0x000001B764E98000-memory.dmp

Download

memory/848-37-0x000001B75C9A0000-0x000001B75C9B0000-memory.dmp

Download

memory/4920-15-0x0000000000B50000-0x0000000000CCA000-memory.dmp

Download

memory/4920-206-0x0000000000B50000-0x0000000000CCA000-memory.dmp

Download

memory/4920-214-0x0000000000B50000-0x0000000000CCA000-memory.dmp

Download

memory/6024-108-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-100-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-127-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-126-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-125-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-124-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-123-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-122-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-121-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-120-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-119-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-118-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-117-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-116-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-115-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-114-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-113-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-112-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-111-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-110-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-109-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-129-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-107-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-106-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-105-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-104-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-103-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-102-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-101-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-128-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-99-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-98-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-97-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-96-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-95-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-94-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-93-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-92-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-91-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-90-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-89-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-88-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-87-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-86-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-134-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-135-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-136-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-139-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-138-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-137-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-145-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-144-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-143-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-142-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-141-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-130-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-131-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-132-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-133-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download

memory/6024-140-0x00000265ADA80000-0x00000265ADA90000-memory.dmp

Download