3f695194d418fed5a3b84558cc23b7a568ef1224a4fb6c9c3b5a209383233d69

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe
Size

21.1MB
MD5

10a4341362b0e3e596a5936e32978e6b
SHA1

a014b912e092d48c6b02d584c3860620a86353dc
SHA256

3f695194d418fed5a3b84558cc23b7a568ef1224a4fb6c9c3b5a209383233d69
SHA512

a442f492d41db30bb19c4f91378ed5447bfb2bc5f71825b0151c65675d4245ce34dd1e6665e1539b0a634cc635383f831970783d04d95d35d85ab2c9fe583f66
SSDEEP

393216:JtUS4AqAW6WcDD0Xp9cB7yf9x1/l+LFKpbh6ay:0S4J3xvXpaAx1/l+Bch6a

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
1272	Game.exe
2900	FalcoGamePlayerSetup.exe
1760	FalcoGamePlayerSetup.tmp
2140	Desolators.exe
1416	FalcoGamePlayer.exe

Loads dropped DLL 16 IoCs

pid	Process
2192	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
2900	FalcoGamePlayerSetup.exe
1760	FalcoGamePlayerSetup.tmp
1760	FalcoGamePlayerSetup.tmp
1272	Game.exe
1272	Game.exe
2140	Desolators.exe
2140	Desolators.exe
2140	Desolators.exe
1760	FalcoGamePlayerSetup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Desolators\html\sprites\b24.png	Desolators.exe
File created	C:\Program Files (x86)\Falco Game Player\is-OFIGV.tmp	FalcoGamePlayerSetup.tmp
File created	C:\Program Files (x86)\Desolators\html\sound\bomber.mp3	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sound\boom.mp3	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sound\uzhos.mp3	Desolators.exe
File opened for modification	C:\Program Files (x86)\Falco Game Player\FalcoGamePlayer.exe	FalcoGamePlayerSetup.tmp
File created	C:\Program Files (x86)\is-2G331.tmp	FalcoGamePlayerSetup.tmp
File created	C:\Program Files (x86)\Desolators\locales\ru.pak	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sound\gimn.ogg	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sprites\exp1.png	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sprites\para0.png	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\keys.js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\sprite.js	Desolators.exe
File opened for modification	C:\Program Files (x86)\Desolators\locales	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sound\fight.ogg	Desolators.exe
File opened for modification	C:\Program Files (x86)\Desolators\html\sprites	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\index.html	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sound\gunshot.ogg	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sprites\smoke.png	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\exp.js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\paratrooper.js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\plan.js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html.7z	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sound\bombdown.mp3	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sound\gimn.mp3	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sound\fight.mp3	Desolators.exe
File opened for modification	C:\Program Files (x86)\Desolators\html\js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\libcef.dll	Desolators.exe
File created	C:\Program Files (x86)\Desolators\unins000.dat	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\is-G0CBB.tmp	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Desolators\html\sprites\irokez.png	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sprites\fon.jpg	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sprites\zenitka.png	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\heli.js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\trooper.js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\libEGL.dll	Desolators.exe
File created	C:\Program Files (x86)\Desolators\is-4M13R.tmp	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Desolators\unins000.dat	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Desolators\html\sound\boom.ogg	Desolators.exe
File created	C:\Program Files (x86)\Falco Game Player\unins000.dat	FalcoGamePlayerSetup.tmp
File created	C:\Program Files (x86)\Desolators\html\sound\helicopter_loop.mp3	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\blood.js	Desolators.exe
File opened for modification	C:\Program Files (x86)\Falco Game Player\FalcoGamePlayer.url	FalcoGamePlayerSetup.tmp
File created	C:\Program Files (x86)\Desolators\html\sound\uzhos.ogg	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sprites\exp0.png	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sprites\heli1.png	Desolators.exe
File created	C:\Program Files (x86)\Desolators\is-M6DF2.tmp	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Desolators\is-2564N.tmp	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Desolators\html\sound\helicopter_loop.ogg	Desolators.exe
File opened for modification	C:\Program Files (x86)\Falco Game Player\unins000.dat	FalcoGamePlayerSetup.tmp
File created	C:\Program Files (x86)\Desolators\html\sprites\start.jpg	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\bomb.js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\smoke.js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\zenitka.js	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sound\gunshot.mp3	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sprites\krovischa.png	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\sprites\para1.png	Desolators.exe
File created	C:\Program Files (x86)\Falco Game Player\is-SDE2G.tmp	FalcoGamePlayerSetup.tmp
File created	C:\Program Files (x86)\is-8LL3C.tmp	FalcoGamePlayerSetup.tmp
File created	C:\Program Files (x86)\Desolators\html\sprites\bomb.png	Desolators.exe
File created	C:\Program Files (x86)\Desolators\html\js\bullet.js	Desolators.exe
File opened for modification	C:\Program Files (x86)\Desolators\FalcoGamePlayerSetup.exe	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Desolators\Desolators.url	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Desolators\7za.dll	Desolators.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FalcoGamePlayerSetup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Desolators.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FalcoGamePlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FalcoGamePlayerSetup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Desolators.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Desolators.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2336	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	Game.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
1760	FalcoGamePlayerSetup.tmp
1760	FalcoGamePlayerSetup.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
1760	FalcoGamePlayerSetup.tmp

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1272	Game.exe
1272	Game.exe
1416	FalcoGamePlayer.exe
1416	FalcoGamePlayer.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2776	2192	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2776	2192	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2776	2192	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2776	2192	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2776	2192	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2776	2192	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2776	2192	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe	30
PID 2776 wrote to memory of 1272	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	33
PID 2776 wrote to memory of 1272	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	33
PID 2776 wrote to memory of 1272	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	33
PID 2776 wrote to memory of 1272	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	33
PID 2776 wrote to memory of 2900	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	34
PID 2776 wrote to memory of 2900	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	34
PID 2776 wrote to memory of 2900	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	34
PID 2776 wrote to memory of 2900	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	34
PID 2776 wrote to memory of 2900	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	34
PID 2776 wrote to memory of 2900	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	34
PID 2776 wrote to memory of 2900	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	34
PID 2900 wrote to memory of 1760	2900	FalcoGamePlayerSetup.exe	35
PID 2900 wrote to memory of 1760	2900	FalcoGamePlayerSetup.exe	35
PID 2900 wrote to memory of 1760	2900	FalcoGamePlayerSetup.exe	35
PID 2900 wrote to memory of 1760	2900	FalcoGamePlayerSetup.exe	35
PID 2900 wrote to memory of 1760	2900	FalcoGamePlayerSetup.exe	35
PID 2900 wrote to memory of 1760	2900	FalcoGamePlayerSetup.exe	35
PID 2900 wrote to memory of 1760	2900	FalcoGamePlayerSetup.exe	35
PID 2776 wrote to memory of 1976	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	36
PID 2776 wrote to memory of 1976	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	36
PID 2776 wrote to memory of 1976	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	36
PID 2776 wrote to memory of 1976	2776	10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp	36
PID 1976 wrote to memory of 2336	1976	cmd.exe	38
PID 1976 wrote to memory of 2336	1976	cmd.exe	38
PID 1976 wrote to memory of 2336	1976	cmd.exe	38
PID 1976 wrote to memory of 2336	1976	cmd.exe	38
PID 1272 wrote to memory of 2140	1272	Game.exe	41
PID 1272 wrote to memory of 2140	1272	Game.exe	41
PID 1272 wrote to memory of 2140	1272	Game.exe	41
PID 1272 wrote to memory of 2140	1272	Game.exe	41
PID 1760 wrote to memory of 1416	1760	FalcoGamePlayerSetup.tmp	43
PID 1760 wrote to memory of 1416	1760	FalcoGamePlayerSetup.tmp	43
PID 1760 wrote to memory of 1416	1760	FalcoGamePlayerSetup.tmp	43
PID 1760 wrote to memory of 1416	1760	FalcoGamePlayerSetup.tmp	43

C:\Users\Admin\AppData\Local\Temp\10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\is-FCJRC.tmp\10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FCJRC.tmp\10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp" /SL5="$400E8,21705086,55296,C:\Users\Admin\AppData\Local\Temp\10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Program Files (x86)\Desolators\Game.exe
    "C:\Program Files (x86)\Desolators\Game.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Program Files (x86)\Desolators\Desolators.exe
      Desolators.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:2140
- - C:\Program Files (x86)\Desolators\FalcoGamePlayerSetup.exe
    "C:\Program Files (x86)\Desolators\FalcoGamePlayerSetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\is-251P8.tmp\FalcoGamePlayerSetup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-251P8.tmp\FalcoGamePlayerSetup.tmp" /SL5="$80158,2863771,55296,C:\Program Files (x86)\Desolators\FalcoGamePlayerSetup.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Program Files (x86)\Falco Game Player\FalcoGamePlayer.exe
        
        "C:\Program Files (x86)\Falco Game Player\FalcoGamePlayer.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c taskkill /f /im rkverify.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rkverify.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Falco Game Player\is-SDE2G.tmp

Filesize
699KB

MD5
4bed42f7e9fe379fb29537d7ffc7d67b

SHA1
dba8f3666519c155c81b7c048a7edabc8d3fe236

SHA256
818d99d99dc8c5f1631144af5f0aeb8d82178c16168b5bc49a9f8e0135069854

SHA512
9e574faa06acd6779d760245c774f6abe98df990d6aaa73cf20a34c35bf3410f31bdb6e833f596865f886f453267e62167262c52dcd25eb73f2db1f387366f1d

Download Submit
C:\Program Files (x86)\Falco.ico

Filesize
3KB

MD5
6cfc02aab3845db4b4161fadcaea4c5f

SHA1
5f977c8527bc96c765c368eb669a254e34b3f898

SHA256
8a757a6115023e3f28c0739f79fdc13d6035fbe22a6c5042cdedf2c484a320d1

SHA512
32041a95cf8cb131f058b31e14bb4639a3385d9fe1a910bec8a517ab4a9223d94dfa28857fe57fe63135eac10d661c2df92e6bb380aee746c7a9c6b4821c2e27

Download Submit
C:\Program Files (x86)\Falco.url

Filesize
46B

MD5
3c342ae18cda361b831693e88dfde457

SHA1
247fb552e87544e42c15f14ccd47b1e58609a91d

SHA256
dc0210515ba93a9456ac6d46c798838506aa2bd334a340024c2b6599aeb902c1

SHA512
1817854abb06c459a1f4ffb65d61a136bec302364dcfb8c8549f78bce05f36dea1cae4a5ffde4f76828f874064046c6e0ca9d9b5882e05114c1adfd63ad83d9f

Download Submit
C:\Users\Admin\Desktop\Falco Freeware Website.lnk

Filesize
928B

MD5
a549fe03dc2026d00ef7bc19dfe293f1

SHA1
9bc3b34b7a658e813f6217bc8dabf32aee46c188

SHA256
b98c544fbc14c91ae34ecedbe74fd875af35235fe4f56b208668563bc01e92ad

SHA512
cb5237fc7a6825b09daf764c70ca89bbac7e7cc556f491dbb9b96484d20bca95736ea54793484a4a137e8d68054106f567c1a2e78a9cbfa2c6828441c55b9b2d

Download Submit
\Program Files (x86)\Desolators\7za.dll

Filesize
278KB

MD5
17bddadca7044cc7b8406f1ca45210df

SHA1
d74c5236542f4ddbb50cd113dedcd05aa9861ca9

SHA256
4406dc1789f1ebdbfebb7796719d21dcce2250f3a0a07f204cfd0b4f93725f6c

SHA512
1abf4e41912e18b77f7e0ea7ce98e0a5760a554cf79c78dd8ccaf04589fc02579b0fbb5a822acf2d098c2362b778821b1e5e870a55cba5834566a723c0716d50

Download Submit
\Program Files (x86)\Desolators\Desolators.exe

Filesize
15.7MB

MD5
126ce53251d0020cbf3a35f2222e3ec4

SHA1
f1e77c714c8a0ed59d0a0314e4d4e20ed04232a0

SHA256
a5b8b05c819f9254aea49fbb0a91e25bd5d6b68b058b2291c32a5054ff5be4d0

SHA512
644501dd6bdedd340c428ff46fe9309fb9357b353f201dbb59595fe3b169e86c1c8cc28e5d614e588f1ed0a9981e41ea32d0e441aa11504caab2e6b69c935e70

Download Submit
\Program Files (x86)\Desolators\FalcoGamePlayerSetup.exe

Filesize
3.1MB

MD5
8c4c9d5b7cef3375118313a577099b05

SHA1
a0979d04018644cee3b02a055fd226c3e1942a99

SHA256
5bc3e8290ee1c0ee5fffa7d883476ab763f05d9413c58d2916dcdcc34bd99adb

SHA512
10ec8dc36bd5384ba60b5ca411f2328017dd1ec425a257a148a02b4eeacf19a745347b98e61f2c0aa88ccca2a531ed8e47deda11616f56befed08e88a7c5bbe5

Download Submit
\Program Files (x86)\Desolators\Game.exe

Filesize
25.6MB

MD5
77f8f918ccb344f47efb8c8cab9bdb8b

SHA1
ff8f3f3c708f6eba7dcdb5dfa9a9f1194893409b

SHA256
6b63d2a0b00a1ae5a526e4360a162497f0d33db1616a8ba71e1c4f58bc5719af

SHA512
82238bda9cd81efce7b594f6abcedb14346d67516bd89728ba2391a980c5e52d3ff6d949f44956098617174b020235a09e3f7d4ca4f5f801bc3728dc49c76ff1

Download Submit
\Program Files (x86)\Desolators\icudt.dll

Filesize
9.5MB

MD5
5434e18b933e03f274d8da59fda4c676

SHA1
9cf34066a3a28bf0dccff0e4b234a9ac22cffb8d

SHA256
ef080ad7436d544c285d026131ad0faa0b54d7e2f098d5c6c5920bbf88b3f6a7

SHA512
0799b6381eb959faa540be6d6a7a8a3b5b8bf5510adc4da039af844c6685a561e1c205d160dcb964caa2a1bbc4cacab9c70a3974f07417c274a0d6ba0157cce2

Download Submit
\Program Files (x86)\Desolators\libcef.dll

Filesize
31.2MB

MD5
d3a050bc5e01f32ecb2a5a8fbf3ff1ed

SHA1
de0097569e96a6599476ba09ca7c7a1aa05f9c20

SHA256
2afcdc71693ab42bada17fb74bf3d1e4bf8114ba71f1bb1c45c5a9cc4e502702

SHA512
e79bb142d6401ca07bf9808314cc77496ee5162a7cc739f1312afc61754ebf3db39769cdef005bac7003c54ba441842b8429d5439f192a5dcd02f336043dcc78

Download Submit
\Program Files (x86)\Desolators\unins000.exe

Filesize
699KB

MD5
5da00d6098a3f9ca91d76e1b326ec7e3

SHA1
0c8668472124e67a5bcdbdc2d126f1387ca15c9b

SHA256
9db23bf2dfa767b840073e36617769d72ff0d546676e84465cfbe3fad316adee

SHA512
8001efd863687e5ae2fc670c21eb2e695156239464b176e6993aef7e39063eba3a125fd7c38df0d4faa34b655997d85bfaf33ea5890673c9475ce25bf67add55

Download Submit
\Program Files (x86)\Falco Game Player\FalcoGamePlayer.exe

Filesize
12.7MB

MD5
b10e34e785d77fcdbd58d5c3d00dacea

SHA1
44257cb697cc51b3df6d93bcf3045d7b13eab06e

SHA256
bbd0d32968cf778fa350cf49fe7d6a64ee76989f6a18ff400480f0614aec529b

SHA512
64d9de67854186e0ea6e171f977595689991dc2a329ddab3f37442e1a1c981230f4267e1e49b4baee75ed2bd0e7cd7c4991d6f55a9f3c9611870e38e1df33afa

Download Submit
\Users\Admin\AppData\Local\Temp\is-0RKVP.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-0RKVP.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
\Users\Admin\AppData\Local\Temp\is-FCJRC.tmp\10a4341362b0e3e596a5936e32978e6b_JaffaCakes118.tmp

Filesize
688KB

MD5
5cd728b172a761eb7d9fed1a0191ffa6

SHA1
298a648fd640480a7638636c4481a03e2c115b6f

SHA256
8bdc8d74bd0b609864e037c28ee852bbcf3cb8bf7bf5e88025e07a7d544367b3

SHA512
653814b2992d7e5f29cf19b61c48aa5bc16ecba877a81cf17a9189197e48a0abffc4b70c167ed0a783b5076a0fc894b73dbd5557802aeb99cc77310daeb8e817

Download Submit
memory/1272-211-0x0000000000400000-0x0000000000DF5000-memory.dmp

Filesize
10.0MB

Download
memory/1272-121-0x0000000000400000-0x0000000000DF5000-memory.dmp

Filesize
10.0MB

Download
memory/1272-103-0x0000000000400000-0x0000000000DF5000-memory.dmp

Filesize
10.0MB

Download
memory/1416-362-0x0000000000400000-0x0000000001148000-memory.dmp

Filesize
13.3MB

Download
memory/1416-474-0x0000000000400000-0x0000000001148000-memory.dmp

Filesize
13.3MB

Download
memory/1416-487-0x0000000000400000-0x0000000001148000-memory.dmp

Filesize
13.3MB

Download
memory/1416-722-0x0000000000400000-0x0000000001148000-memory.dmp

Filesize
13.3MB

Download
memory/1416-735-0x0000000000400000-0x0000000001148000-memory.dmp

Filesize
13.3MB

Download
memory/1760-105-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1760-223-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1760-214-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1760-123-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1760-108-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2140-215-0x0000000000400000-0x00000000013B3000-memory.dmp

Filesize
15.7MB

Download
memory/2192-24-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2192-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2192-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2192-86-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2776-23-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2776-36-0x00000000008C0000-0x00000000008FC000-memory.dmp

Filesize
240KB

Download
memory/2776-27-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2776-26-0x00000000008C0000-0x00000000008FC000-memory.dmp

Filesize
240KB

Download
memory/2776-32-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2776-85-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2776-35-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2776-29-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2776-22-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2776-8-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2776-17-0x00000000008C0000-0x00000000008FC000-memory.dmp

Filesize
240KB

Download
memory/2776-21-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2776-20-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2900-224-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2900-104-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2900-71-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download