Malware Analysis Report

2025-08-05 15:29

Sample ID 221019-tt12wsfef6
Target f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5
SHA256 f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5
Tags
darkcomet rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5

Threat Level: Known bad

The file f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5 was found to be: Known bad.

Malicious Activity Summary

darkcomet rat trojan

Darkcomet

Suspicious use of SetThreadContext

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2022-10-19 16:21

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 16:21

Reported

2022-10-19 18:49

Platform

win7-20220812-en

Max time kernel

154s

Max time network

47s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"

Signatures

Darkcomet

trojan rat darkcomet

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 2016 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe

"C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"

C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe

C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 charliesheen.no-ip.biz udp

Files

memory/2016-54-0x0000000076711000-0x0000000076713000-memory.dmp

memory/916-55-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-56-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-60-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-65-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-64-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-62-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-58-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-67-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-70-0x000000000048C87C-mapping.dmp

memory/916-69-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-72-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2016-71-0x0000000000230000-0x0000000000234000-memory.dmp

memory/916-74-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-75-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/916-76-0x0000000000400000-0x00000000004AF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-19 16:21

Reported

2022-10-19 18:49

Platform

win10v2004-20220812-en

Max time kernel

163s

Max time network

182s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"

Signatures

Darkcomet

trojan rat darkcomet

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe
PID 3980 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe

"C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe"

C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe

C:\Users\Admin\AppData\Local\Temp\f2d1a786e8060392d1e3d8343606a698599e6d0a8cc55d1f96173e9d1b29dbd5.exe

Network

Country Destination Domain Proto
US 72.21.91.29:80 tcp
IE 13.69.239.72:443 tcp
US 72.21.91.29:80 tcp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp
US 8.8.8.8:53 charliesheen.no-ip.biz udp

Files

memory/1688-132-0x0000000000000000-mapping.dmp

memory/1688-133-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/1688-134-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/3980-135-0x00000000005A0000-0x00000000005A4000-memory.dmp

memory/1688-136-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/1688-137-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/1688-138-0x0000000000400000-0x00000000004AF000-memory.dmp