Malware Analysis Report

2024-08-06 17:30

Sample ID 240627-lzj2kavfqd
Target 1593241035013c441a7a4b0facf68d11_JaffaCakes118
SHA256 c71228dd40c9cca4cf7dbd4d36bd92b3857ce006fbdadba7607457d8d04678e5
Tags
guest16 darkcomet rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c71228dd40c9cca4cf7dbd4d36bd92b3857ce006fbdadba7607457d8d04678e5

Threat Level: Known bad

The file 1593241035013c441a7a4b0facf68d11_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

guest16 darkcomet rat trojan

Darkcomet family

Darkcomet

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-27 09:58

Signatures

Darkcomet family

darkcomet

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-27 09:58

Reported

2024-06-27 10:00

Platform

win7-20240419-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2176 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 2176 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 2176 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 2176 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 2176 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 2176 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 2176 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 2176 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE

"C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE"

C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE

"C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE"

Network

Country Destination Domain Proto
US 8.8.8.8:53 dr-hacker.no-ip.org udp

Files

memory/2176-8-0x00000000771C1000-0x00000000771C2000-memory.dmp

memory/2176-7-0x00000000002B0000-0x00000000002C0000-memory.dmp

memory/2176-6-0x0000000000280000-0x0000000000290000-memory.dmp

memory/2176-5-0x00000000771BF000-0x00000000771C0000-memory.dmp

memory/2176-4-0x00000000771C0000-0x00000000771C1000-memory.dmp

memory/2176-3-0x0000000000290000-0x00000000002A0000-memory.dmp

memory/2176-2-0x00000000002B0000-0x00000000002C0000-memory.dmp

memory/2176-1-0x0000000001EA0000-0x0000000001ED9000-memory.dmp

memory/2176-0-0x0000000000260000-0x0000000000264000-memory.dmp

memory/2176-9-0x00000000771F8000-0x00000000771F9000-memory.dmp

memory/2176-10-0x0000000000350000-0x0000000000351000-memory.dmp

memory/2176-11-0x0000000001FB0000-0x00000000020B0000-memory.dmp

memory/2176-13-0x0000000076CA9000-0x0000000076CAA000-memory.dmp

\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE

MD5 cde53926cc3102f8dc248675cadb45f2
SHA1 fd54ace3fc301c53e3772613970247556adfc634
SHA256 8a8536d5a062633abf2b6657347b919e30146cca4be04bd10d141d7dff95dc77
SHA512 06d81e13bda87f4cfe4d3bff538beafa4fe3a2a69d3325f43c6897803a43aa0d784413c86404fe940977a180593c7bfcad6f778650ad4f5d0a283ec894e78de4

memory/2644-19-0x000007FEF481E000-0x000007FEF481F000-memory.dmp

memory/2644-20-0x000007FEF4560000-0x000007FEF4EFD000-memory.dmp

memory/2644-21-0x000007FEF4560000-0x000007FEF4EFD000-memory.dmp

memory/2644-24-0x000007FEF4560000-0x000007FEF4EFD000-memory.dmp

memory/2176-25-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-30-0x00000000002B0000-0x00000000002C0000-memory.dmp

memory/2176-29-0x0000000000280000-0x0000000000290000-memory.dmp

memory/2176-28-0x0000000000290000-0x00000000002A0000-memory.dmp

memory/2176-27-0x00000000002B0000-0x00000000002C0000-memory.dmp

memory/2176-26-0x0000000001EA0000-0x0000000001ED9000-memory.dmp

memory/2176-31-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2644-32-0x000007FEF4560000-0x000007FEF4EFD000-memory.dmp

memory/2644-33-0x000007FEF481E000-0x000007FEF481F000-memory.dmp

memory/2176-34-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-35-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-36-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-37-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-38-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-39-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-40-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-41-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-42-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-43-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-44-0x0000000000400000-0x000000000055C000-memory.dmp

memory/2176-45-0x0000000000400000-0x000000000055C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-27 09:58

Reported

2024-06-27 10:00

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 440 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 440 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 440 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE
PID 440 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1593241035013c441a7a4b0facf68d11_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE

"C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE"

C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE

"C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 160.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp
US 8.8.8.8:53 dr-hacker.no-ip.org udp

Files

memory/440-3-0x00000000776D2000-0x00000000776D3000-memory.dmp

memory/440-2-0x00000000022E0000-0x00000000022F0000-memory.dmp

memory/440-1-0x00000000021C0000-0x00000000021F9000-memory.dmp

memory/440-0-0x0000000002180000-0x0000000002184000-memory.dmp

memory/440-6-0x0000000075971000-0x0000000075972000-memory.dmp

memory/440-5-0x00000000023E0000-0x00000000023F0000-memory.dmp

memory/440-7-0x0000000075950000-0x0000000075A40000-memory.dmp

memory/440-9-0x0000000075950000-0x0000000075A40000-memory.dmp

memory/440-8-0x0000000075950000-0x0000000075A40000-memory.dmp

memory/440-4-0x00000000025A0000-0x00000000025B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GAMEZER POINT EDITER.EXE

MD5 cde53926cc3102f8dc248675cadb45f2
SHA1 fd54ace3fc301c53e3772613970247556adfc634
SHA256 8a8536d5a062633abf2b6657347b919e30146cca4be04bd10d141d7dff95dc77
SHA512 06d81e13bda87f4cfe4d3bff538beafa4fe3a2a69d3325f43c6897803a43aa0d784413c86404fe940977a180593c7bfcad6f778650ad4f5d0a283ec894e78de4

memory/1916-21-0x00007FFA86ED5000-0x00007FFA86ED6000-memory.dmp

memory/1916-22-0x000000001BBF0000-0x000000001BC96000-memory.dmp

memory/1916-23-0x00007FFA86C20000-0x00007FFA875C1000-memory.dmp

memory/1916-24-0x000000001C170000-0x000000001C63E000-memory.dmp

memory/1916-25-0x00007FFA86C20000-0x00007FFA875C1000-memory.dmp

memory/1916-27-0x000000001C750000-0x000000001C7EC000-memory.dmp

memory/3956-28-0x00007FFA86C20000-0x00007FFA875C1000-memory.dmp

memory/3956-29-0x00007FFA86C20000-0x00007FFA875C1000-memory.dmp

memory/1916-30-0x00000000014F0000-0x00000000014F8000-memory.dmp

memory/3956-31-0x00007FFA86C20000-0x00007FFA875C1000-memory.dmp

memory/3956-32-0x000000001C340000-0x000000001C38C000-memory.dmp

memory/440-33-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-34-0x0000000075950000-0x0000000075A40000-memory.dmp

memory/440-35-0x00000000021C0000-0x00000000021F9000-memory.dmp

memory/440-37-0x00000000025A0000-0x00000000025B0000-memory.dmp

memory/440-39-0x0000000075950000-0x0000000075A40000-memory.dmp

memory/440-38-0x00000000023E0000-0x00000000023F0000-memory.dmp

memory/440-36-0x00000000022E0000-0x00000000022F0000-memory.dmp

memory/440-40-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-41-0x0000000075950000-0x0000000075A40000-memory.dmp

memory/1916-43-0x00007FFA86ED5000-0x00007FFA86ED6000-memory.dmp

memory/440-42-0x0000000000400000-0x000000000055C000-memory.dmp

memory/1916-44-0x00007FFA86C20000-0x00007FFA875C1000-memory.dmp

memory/3956-45-0x00007FFA86C20000-0x00007FFA875C1000-memory.dmp

memory/440-46-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-47-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-48-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-49-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-50-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-51-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-52-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-53-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-54-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-55-0x0000000000400000-0x000000000055C000-memory.dmp

memory/440-56-0x0000000000400000-0x000000000055C000-memory.dmp