ramsay | a477de8cadaf2d150b4d5b84c7f8dd0875bfe67ded825b254d67af6c50ca43b2

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe
Size 2.5MB
Sample261026-rff4fsbc45
SHA256 a477de8cadaf2d150b4d5b84c7f8dd0875bfe67ded825b254d67af6c50ca43b2
MD5 bce4d31682c2ef488a8330498e517534
SHA1 ece66515185e1659913145f661d7e5ba2cd64505
SHA512 4c46ee2076daddb464f28b191ebd0089ef07fc8fcf794c7acef26ee4bdf8d1f76314b8f431014674206a5d657806b9d7eef354705a44c4bad1a352757a05fa58
SSDEEP 49152:QhLvOxPvUtOl4OoBdqTDtSQWGtrvOxPvUtOl40k7wFFbNCwTvSm5sL:COxPvUtOl4OoqTB3NOxPvUtOl40IAFJK
TLSH
T157C5F173B900C1D2D8701C77D16E12F0966F7DE5C929888F136A7E2AB6B16E74B24783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework persistence rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/5192-198-0x0000000000080000-0x00000000001FA000-memory.dmp	family_ramsay_payload
behavioral1/files/0x0007000000024685-204.dat	family_ramsay_payload
behavioral1/memory/5192-210-0x0000000000080000-0x00000000001FA000-memory.dmp	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/5192-198-0x0000000000080000-0x00000000001FA000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/5192-210-0x0000000000080000-0x00000000001FA000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/5192-198-0x0000000000080000-0x00000000001FA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/5192-210-0x0000000000080000-0x00000000001FA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/5192-198-0x0000000000080000-0x00000000001FA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/5192-210-0x0000000000080000-0x00000000001FA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024671-13.dat	UPX
behavioral1/memory/5192-15-0x0000000000080000-0x00000000001FA000-memory.dmp	UPX
behavioral1/memory/5192-198-0x0000000000080000-0x00000000001FA000-memory.dmp	UPX
behavioral1/memory/5192-210-0x0000000000080000-0x00000000001FA000-memory.dmp	UPX

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	jljvgalhai.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe

Executes dropped EXE 8 IoCs

pid	Process
5768	jljvgalhai.exe
5192	zowgxiggjc.exe
1240	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe
2780	eidolon.exe
5792	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe
2308	USBServers32.exe
4716	USBServers32.exe
1796	bindsvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\USBServers32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\USBServers32.exe"	reg.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\system32\msfte.dll	zowgxiggjc.exe
File opened for modification	C:\Windows\SysWOW64\shell32.dll	eidolon.exe
File created	C:\Windows\system32\oci.dll	zowgxiggjc.exe
File created	C:\Windows\SysWOW64\wideshut.exe	zowgxiggjc.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	zowgxiggjc.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	zowgxiggjc.exe
File created	C:\Windows\System32\bindsvc.exe	zowgxiggjc.exe
File created	C:\Windows\SysWOW64\racfg.exe	zowgxiggjc.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	zowgxiggjc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024671-13.dat	upx
behavioral1/memory/5192-15-0x0000000000080000-0x00000000001FA000-memory.dmp	upx
behavioral1/memory/5192-198-0x0000000000080000-0x00000000001FA000-memory.dmp	upx
behavioral1/memory/5192-210-0x0000000000080000-0x00000000001FA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5304	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2404	cmd.exe
4312	cmd.exe
3348	cmd.exe
2448	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eidolon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eidolon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bindsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bindsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zowgxiggjc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eidolon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBServers32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jljvgalhai.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4c9386a5365dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007113a46a5365dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d295486b5365dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e836e96a5365dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b16666a5365dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc26986a5365dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b077876a5365dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e871036b5365dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000836d7f6b5365dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5192	zowgxiggjc.exe
5192	zowgxiggjc.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	552	SearchIndexer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 5768	1076	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe	86
PID 1076 wrote to memory of 5192	1076	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe	87
PID 5768 wrote to memory of 1240	5768	jljvgalhai.exe	89
PID 1240 wrote to memory of 2780	1240	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe	90
PID 1240 wrote to memory of 2448	1240	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe	91
PID 1240 wrote to memory of 2404	1240	2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe	92
PID 2404 wrote to memory of 5792	2404	cmd.exe	95
PID 552 wrote to memory of 1792	552	SearchIndexer.exe	96
PID 552 wrote to memory of 3956	552	SearchIndexer.exe	97
PID 2404 wrote to memory of 2308	2404	cmd.exe	104
PID 2308 wrote to memory of 4312	2308	USBServers32.exe	105
PID 4312 wrote to memory of 4068	4312	cmd.exe	107
PID 5192 wrote to memory of 3532	5192	zowgxiggjc.exe	112
PID 3532 wrote to memory of 5304	3532	cmd.exe	114
PID 5192 wrote to memory of 3348	5192	zowgxiggjc.exe	115
PID 5192 wrote to memory of 1796	5192	zowgxiggjc.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\jljvgalhai.exe
  "C:\Users\Admin\AppData\Local\Temp\jljvgalhai.exe" "C:\Users\Admin\AppData\Local\Temp\uldacqcxcm.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Users\Admin\AppData\Local\Temp\2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\eidolon.exe
      "C:\Users\Admin\AppData\Local\Temp\eidolon.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:2780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttdelzzz.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2448
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\temp\tttbrozzz.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-10-25_bce4d31682c2ef488a8330498e517534_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_s.exe"
        5⤵
        Executes dropped EXE
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
        
        "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2308
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\windows\currentVersion\run /v USBServers32 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\USBServers32.exe" /f
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4068
- C:\Users\Admin\AppData\Local\Temp\zowgxiggjc.exe
  C:\Users\Admin\AppData\Local\Temp\zowgxiggjc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ja9Nteha.bat"
    3⤵
    - Executes a command shell one-liner
    PID:3348
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1796

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1792
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 808 812 820 8192 816 792
  2⤵
  - Modifies data under HKEY_USERS
  PID:3956

C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
1⤵
- Executes dropped EXE
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

USBServers32.exe

Path C:\Users\Admin\AppData\Local\Temp\USBServers32.exe
Size 54KB
SHA256 8f53ab3cd172f685568e0cbb51eb7dfd2389a5fe6aaf47d0aa7d823253e673ee
MD5 6428b1de8971e837926de5b464725f64
SHA1 19d7ce6fff617b790f9de7bf99406e61061f0594
SHA512 7938b01ce48bcdd3276c83f82fc71407d101f2e884b3f271a17fcf4c60af642faf57047edab97906351217f79847107757283af3fbfc3059cf4eb8e8d778d026
SSDEEP 768:nj27aTwKrJgJapOgV0jvQbtgDDM1MEprbhrCTyYrKjA70QkwWyit3JvsgZaphsL7:nj2AwKrSEqLQxK+oyEIXQ7+JLIzbPhwj
TLSH
T1D643D083BA8688E2C410357025977B32CA176FD25085F4A6EF31FDA0E4FF15A942DE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eidolon.exe

Path C:\Users\Admin\AppData\Local\Temp\eidolon.exe
Size 24KB
SHA256 a1bf9bc23f97fee5a83ddcb3ba4d8fbbcc70fb2d871b325261be0ded72196fe9
MD5 f3858fb30c8ddb74a11e85381009c438
SHA1 ab388dbb45109acd543d28030daf065e50e20a1b
SHA512 6aeb783c6ed7108480f956fd5b54a39a26d6257dc1c472d4d16700eb76be4276690596702fbc9a078662627673965584accf90449cd08dec461806ae3d57c0d1
SSDEEP 384:NxJGCZWgs7ZS1DJKfkojki7gMbaoSnWbwPxTP3CUJ5tvOb/jl81:NGMWb74DJKcaki1v4fP3Cme0
TLSH
T16FB23A03FAC744F6E905A570456B7B3A9A2F6E5A0710D6CBCB4CFDA484321E2D9B124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja9Nteha.bat

Path C:\Users\Admin\AppData\Local\Temp\ja9Nteha.bat
Size 196B
SHA256 55e057c929db93082f3b44ab31f7d5528138cf233c791de02fdc8e68afa42059
MD5 2fb356151dc924350ee48607ab52fede
SHA1 8195329eeaf293f6651bdd1b36fef96e86ace85a
SHA512 9be439231a5f5a78d7b8a45fb4bb2ab65dd691a3dd1a7f51dcb25991c32f99b270ad5cb92d654eccaedba6eae1642caf66f76e3403f9539f6f56500abb4ca747
TLSH
T191D0C91182DBCB5F0488915B06A197CEC070CC183F8B2721A72294C8228240DB9E3245
MD5 SHA1 SHA512 TLSH

Submit Download

jljvgalhai.exe

Path C:\Users\Admin\AppData\Local\Temp\jljvgalhai.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uldacqcxcm.exe

Path C:\Users\Admin\AppData\Local\Temp\uldacqcxcm.exe
Size 1.2MB
SHA256 95d550327016dea4d420e0dc9383a2031f9dd968f1338c18060d852af230f45e
MD5 e634073cb65b7295df45665f4c0bce7f
SHA1 e47a5804bd47f02e8297b562abe3872c8859349c
SHA512 8e1c4002baeb683c23f0880da07a69f89498d1abee548fbda05ddd1a124ff3ed9e22adbd5a4feb539e23a10352c259ef9b0f5215d0aa612bc1b0d7fd3c3c14fc
SSDEEP 24576:+wqvzI5S+Pq8zaTJz5Ol4sAOFAszIr74TkyiCFbQtBoCwTtpSDy5sJJ:avOxPvUtOl40k7wFFbNCwTvSm5sr
TLSH
T1AC55F173BD00D1C2D8702C77D16E12F4966F6DE5D819884F126ABE2AB2F16A74B187C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zowgxiggjc.exe

Path C:\Users\Admin\AppData\Local\Temp\zowgxiggjc.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 8797b6787f7d0cb07f2900a4498f2f108f6c8db56b820b054770d29c88d78a53
MD5 ac715c7a13b0bcf248a3a3c59b7bdd8e
SHA1 e41ccbbff270b749ad0cea9a7107409f0bd7a71c
SHA512 32a30d22468deab89de6962407a833280b54a7276075747cc4209c989f3a03b1ad20c3c180e886c731139b52f39fd2144281ac55cd5fcd5bb75a35ded892f2fd
TLSH
T1D6214967ABC33823813A47256BB8C6F7C957F01D6BE84B02912B7625C3635F9132949F
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Server32History.dat

Path C:\Windows\temp\Server32History.dat
Size 656KB
SHA256 9329026e0feb889d73036012ec5d913ba0f45232f0cd06265b55aacde7e89726
MD5 66a3dc8363082b4cf77b78810d13e444
SHA1 c07b2926bed38b8395744679e7ae7f6de8afe350
SHA512 d20471dca2bf596d54b8ac9e48ec7c13a4ff053abf4210263c1bcca23bfc274161ea76e1deb4d9a0e8dd08cda5894d7ac2e3102cecbbdccfb046f0a3efdb0b06
SSDEEP 12288:i2NCD1Jr3deAqvz+b5S+PqyDXzaTJOI5OlUN:ObLqvzI5S+Pq8zaTJz5Ol4
TLSH
T156E49E337940D1C5D8701D77C16A16F0A36F7CE5C9194A4F02AA7E2ABAB26974F28783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tttbrozzz.bat

Path C:\Windows\temp\tttbrozzz.bat
Size 727B
SHA256 3e4d536d8d5d3b21bc9e14f570d1c08d5ee33a4eb388db34523d423c3f13d368
MD5 9aea74ccf0fffa72656646d0c78a927d
SHA1 87879ae63bd55bf7c0043e755bdde894910667e2
SHA512 69a4b168b6a444e10a163c63ef4ead086879b75c987a6a4cf3ddbe1ff83c9fa72a3dcf34f0d9bd168c957c33638fc772b376477f85618a9637a7ba2c5d096f77
TLSH
T158019C084AADC77614A4651E07F2E50AD22C98FAAF441F049B24930D70F8A47FDAB201
MD5 SHA1 SHA512 TLSH

Submit Download

tttdelzzz.bat

Path C:\Windows\temp\tttdelzzz.bat
Size 399B
SHA256 0505c871d87ad693c5c5ca03a9b8b8a0234e2dd4938193d52006ee31ad4b2402
MD5 c28d3d312fcf7cc9374629e55dd8dee1
SHA1 963bde88b455cf0c043d065c132ce29c3e5fcd0e
SHA512 433f2af24f6ab1a4b74d089bebe03433ee577bae66ce743ea21dbd488e56a612774880bab2c2ff8eba12dac47791714151059ac6b07b31fc7e27a157c180031b
TLSH
T1ABE02B481DACD75245B4255D43F6E506DA2C69EB5E041B05AB24524864B8746FC9F100
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-92-0x0000017A66F00000-0x0000017A66F08000-memory.dmp

Download

memory/552-53-0x0000017A65780000-0x0000017A65788000-memory.dmp

Download

memory/552-37-0x0000017A5D3D0000-0x0000017A5D3E0000-memory.dmp

Download

memory/552-21-0x0000017A5D190000-0x0000017A5D1A0000-memory.dmp

Download

memory/3956-124-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-129-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-103-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-102-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-101-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-100-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-99-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-98-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-97-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-96-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-95-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-94-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-110-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-111-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-113-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-115-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-114-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-112-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-116-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-120-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-121-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-122-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-125-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-105-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-123-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-119-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-118-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-117-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-126-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-127-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-128-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-104-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-130-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-131-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-132-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-135-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-137-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-138-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-140-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-141-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-139-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-136-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-134-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-133-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-153-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-152-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-151-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-150-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-149-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-148-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-147-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-146-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-145-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-144-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-143-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-142-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-106-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-109-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-108-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/3956-107-0x000002961D190000-0x000002961D1A0000-memory.dmp

Download

memory/5192-210-0x0000000000080000-0x00000000001FA000-memory.dmp

Download

memory/5192-198-0x0000000000080000-0x00000000001FA000-memory.dmp

Download

memory/5192-15-0x0000000000080000-0x00000000001FA000-memory.dmp

Download