darkcomet | 2c010bcae341cf1003c194a4b566a0cb0c8dff2443d2f9fbd9e7a2d9abc8af6a

Analysis

max time kernel
323s
max time network
328s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
29-10-2024 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OptiFine_1.19.4_HD_U_I4.jar
Size

6.7MB
MD5

2e58bf463ec7e9964fe381a5afc17da1
SHA1

40a44c00d4f06ba82e97b8eb71aab3823f4e9d93
SHA256

2c010bcae341cf1003c194a4b566a0cb0c8dff2443d2f9fbd9e7a2d9abc8af6a
SHA512

94d0673370168322cc6ba5ae7bc9ad5d5c4246aa10f8929239dedc25639255c807c32ea248ee751c42aed9ca61cf37ab391d7d3a9ba57bc643e091c9ef4009d1
SSDEEP

98304:+4T54pxq3gbAuFu0Lw6jEKuBj036dh1KyMH9vPMDNgPjDbHA:+4TCxq3gtFuiWKufdh1jA9H7LPg

Score

10^/10

darkcomet tereefds discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

tereefds

10.127.0.205:1604

Mutex

DCMIN_MUTEX-69DVLDW

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
eFZw5QzKBPc5
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

dfssdfsdf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	dfssdfsdf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dfssdfsdf.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	dfssdfsdf.exe

Executes dropped EXE 29 IoCs

Processes:

upnp.exefrsfd.exefrsfd.exefrsfd.exefrsfd.exefrsfd.exeUPX.exeg.exeg.exeg.exeg.exeg.exedfssdfsdf.exeIMDCSC.exedfssdfsdf.exefrsfd.exefrsfd.exeg.exeg.exeg.exeUPX.exeUPX.exeupnp.exefrsfd.exefrsfd.exefrsfd.exefrsfd.exefrsfd.exefrsfd.exe

pid	Process
2216	upnp.exe
5752	frsfd.exe
5892	frsfd.exe
5944	frsfd.exe
5976	frsfd.exe
6012	frsfd.exe
5332	UPX.exe
3616	g.exe
3424	g.exe
5296	g.exe
4196	g.exe
1564	g.exe
5632	dfssdfsdf.exe
1688	IMDCSC.exe
5760	dfssdfsdf.exe
5672	frsfd.exe
2264	frsfd.exe
2444	g.exe
5820	g.exe
5916	g.exe
1176	UPX.exe
64	UPX.exe
5880	upnp.exe
4440	frsfd.exe
5640	frsfd.exe
2444	frsfd.exe
5848	frsfd.exe
5440	frsfd.exe
1832	frsfd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dfssdfsdf.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	dfssdfsdf.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x0028000000045292-831.dat	upx
behavioral1/memory/2216-837-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2216-841-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/files/0x00280000000452ae-887.dat	upx
behavioral1/memory/5332-888-0x0000000000400000-0x000000000057E000-memory.dmp	upx
behavioral1/memory/5332-901-0x0000000000400000-0x000000000057E000-memory.dmp	upx
behavioral1/memory/5332-908-0x0000000000400000-0x000000000057E000-memory.dmp	upx
behavioral1/files/0x00290000000452ad-910.dat	upx
behavioral1/memory/1564-911-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1564-913-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2444-935-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/5820-937-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/5916-939-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1176-1190-0x0000000000400000-0x000000000057E000-memory.dmp	upx
behavioral1/memory/64-1193-0x0000000000400000-0x000000000057E000-memory.dmp	upx
behavioral1/memory/5880-1261-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f8ec8e41-e056-4509-8a85-54ba5be23f6b.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241029063124.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

frsfd.exeUPX.exeDarkComet.exefrsfd.exeg.exeUPX.exeg.exeg.exeg.exedfssdfsdf.exeIMDCSC.exefrsfd.exefrsfd.exeDarkComet.exefrsfd.exeg.exeg.exefrsfd.exefrsfd.exefrsfd.exefrsfd.exeupnp.exefrsfd.exeg.exeg.exedfssdfsdf.exefrsfd.exefrsfd.exefrsfd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UPX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DarkComet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UPX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfssdfsdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IMDCSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DarkComet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfssdfsdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frsfd.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

Processes:

ipconfig.exe

pid	Process
5480	ipconfig.exe

Modifies registry class 51 IoCs

Processes:

DarkComet.exefirefox.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	DarkComet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "8"	DarkComet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	DarkComet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "7"	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	DarkComet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Documents"	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000009bd8c5405b25db015560c1786325db015560c1786325db0114000000	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	DarkComet.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	DarkComet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	DarkComet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	DarkComet.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	DarkComet.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description	ioc	Process
File created	C:\Users\Admin\Downloads\DarkComet-RAT-5.3.1-master.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid	Process
1460	msedge.exe
1460	msedge.exe
2652	msedge.exe
2652	msedge.exe
3456	identity_helper.exe
3456	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

DarkComet.exeDarkComet.exe

pid	Process
4720	DarkComet.exe
1744	DarkComet.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exefrsfd.exefrsfd.exefrsfd.exe

description	pid	Process
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeDebugPrivilege	1116	firefox.exe
Token: SeIncreaseQuotaPrivilege	5752	frsfd.exe
Token: SeSecurityPrivilege	5752	frsfd.exe
Token: SeTakeOwnershipPrivilege	5752	frsfd.exe
Token: SeLoadDriverPrivilege	5752	frsfd.exe
Token: SeSystemProfilePrivilege	5752	frsfd.exe
Token: SeSystemtimePrivilege	5752	frsfd.exe
Token: SeProfSingleProcessPrivilege	5752	frsfd.exe
Token: SeIncBasePriorityPrivilege	5752	frsfd.exe
Token: SeCreatePagefilePrivilege	5752	frsfd.exe
Token: SeBackupPrivilege	5752	frsfd.exe
Token: SeRestorePrivilege	5752	frsfd.exe
Token: SeShutdownPrivilege	5752	frsfd.exe
Token: SeDebugPrivilege	5752	frsfd.exe
Token: SeSystemEnvironmentPrivilege	5752	frsfd.exe
Token: SeChangeNotifyPrivilege	5752	frsfd.exe
Token: SeRemoteShutdownPrivilege	5752	frsfd.exe
Token: SeUndockPrivilege	5752	frsfd.exe
Token: SeManageVolumePrivilege	5752	frsfd.exe
Token: SeImpersonatePrivilege	5752	frsfd.exe
Token: SeCreateGlobalPrivilege	5752	frsfd.exe
Token: 33	5752	frsfd.exe
Token: 34	5752	frsfd.exe
Token: 35	5752	frsfd.exe
Token: 36	5752	frsfd.exe
Token: SeIncreaseQuotaPrivilege	5892	frsfd.exe
Token: SeSecurityPrivilege	5892	frsfd.exe
Token: SeTakeOwnershipPrivilege	5892	frsfd.exe
Token: SeLoadDriverPrivilege	5892	frsfd.exe
Token: SeSystemProfilePrivilege	5892	frsfd.exe
Token: SeSystemtimePrivilege	5892	frsfd.exe
Token: SeProfSingleProcessPrivilege	5892	frsfd.exe
Token: SeIncBasePriorityPrivilege	5892	frsfd.exe
Token: SeCreatePagefilePrivilege	5892	frsfd.exe
Token: SeBackupPrivilege	5892	frsfd.exe
Token: SeRestorePrivilege	5892	frsfd.exe
Token: SeShutdownPrivilege	5892	frsfd.exe
Token: SeDebugPrivilege	5892	frsfd.exe
Token: SeSystemEnvironmentPrivilege	5892	frsfd.exe
Token: SeChangeNotifyPrivilege	5892	frsfd.exe
Token: SeRemoteShutdownPrivilege	5892	frsfd.exe
Token: SeUndockPrivilege	5892	frsfd.exe
Token: SeManageVolumePrivilege	5892	frsfd.exe
Token: SeImpersonatePrivilege	5892	frsfd.exe
Token: SeCreateGlobalPrivilege	5892	frsfd.exe
Token: 33	5892	frsfd.exe
Token: 34	5892	frsfd.exe
Token: 35	5892	frsfd.exe
Token: 36	5892	frsfd.exe
Token: SeIncreaseQuotaPrivilege	5944	frsfd.exe
Token: SeSecurityPrivilege	5944	frsfd.exe
Token: SeTakeOwnershipPrivilege	5944	frsfd.exe
Token: SeLoadDriverPrivilege	5944	frsfd.exe
Token: SeSystemProfilePrivilege	5944	frsfd.exe
Token: SeSystemtimePrivilege	5944	frsfd.exe
Token: SeProfSingleProcessPrivilege	5944	frsfd.exe
Token: SeIncBasePriorityPrivilege	5944	frsfd.exe
Token: SeCreatePagefilePrivilege	5944	frsfd.exe
Token: SeBackupPrivilege	5944	frsfd.exe

Suspicious use of FindShellTrayWindow 37 IoCs

Processes:

firefox.exeDarkComet.exemsedge.exeDarkComet.exe

pid	Process
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
2652	msedge.exe
4720	DarkComet.exe
1744	DarkComet.exe
1744	DarkComet.exe
1744	DarkComet.exe
1744	DarkComet.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

firefox.exeDarkComet.exeDarkComet.exe

pid	Process
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
1744	DarkComet.exe
1744	DarkComet.exe
1744	DarkComet.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

java.exefirefox.exeOpenWith.exeDarkComet.exeIMDCSC.exeDarkComet.exe

pid	Process
3220	java.exe
1116	firefox.exe
3220	java.exe
1116	firefox.exe
1116	firefox.exe
1116	firefox.exe
4456	OpenWith.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
4720	DarkComet.exe
1688	IMDCSC.exe
1744	DarkComet.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	Process	procid_target
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 2292 wrote to memory of 1116	2292	firefox.exe	85
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 4756	1116	firefox.exe	86
PID 1116 wrote to memory of 2188	1116	firefox.exe	87
PID 1116 wrote to memory of 2188	1116	firefox.exe	87
PID 1116 wrote to memory of 2188	1116	firefox.exe	87
PID 1116 wrote to memory of 2188	1116	firefox.exe	87
PID 1116 wrote to memory of 2188	1116	firefox.exe	87
PID 1116 wrote to memory of 2188	1116	firefox.exe	87
PID 1116 wrote to memory of 2188	1116	firefox.exe	87
PID 1116 wrote to memory of 2188	1116	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\OptiFine_1.19.4_HD_U_I4.jar
1⤵
- Suspicious use of SetWindowsHookEx
PID:3220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1856 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48876a76-2720-47d7-9943-fb080582a6f9} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" gpu
    3⤵
    PID:4756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07bc65d2-5555-475b-96c2-af40adeba819} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" socket
    3⤵
    PID:2188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2864 -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 2768 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {488819dc-3f08-4647-a1a0-4cffbf162878} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
    3⤵
    PID:1988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3644 -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3632 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c34da01a-a8db-42e6-a5c1-739be14e6dc4} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
    3⤵
    PID:3652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4652 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4696 -prefMapHandle 4840 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbbd20aa-94f0-4bab-9106-892fd2f24529} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" utility
    3⤵
    - Checks processor information in registry
    PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5244 -childID 3 -isForBrowser -prefsHandle 5236 -prefMapHandle 5232 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6f03880-05a1-40a0-b600-ce587b99a1f5} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
    3⤵
    PID:2656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 4 -isForBrowser -prefsHandle 5400 -prefMapHandle 5272 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {609a3201-7c59-4cc3-95bc-6d559b182630} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
    3⤵
    PID:2472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 5 -isForBrowser -prefsHandle 5576 -prefMapHandle 5580 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fea9a21-5543-449c-a97c-718430056ad1} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
    3⤵
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6152 -childID 6 -isForBrowser -prefsHandle 6132 -prefMapHandle 6128 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6775430-b0aa-4c25-8fa7-ef1e124c854c} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
    3⤵
    PID:4376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5844 -childID 7 -isForBrowser -prefsHandle 6488 -prefMapHandle 6460 -prefsLen 27777 -prefMapSize 244658 -jsInitHandle 1056 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2365ff5-559c-4a6c-a608-a20262c904ff} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" tab
    3⤵
    PID:4696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4456

C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe
"C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4720
- C:\Users\Admin\AppData\Local\Temp\upnp.exe
  "C:\Users\Admin\AppData\Local\Temp\upnp.exe" -a 10.127.0.205 1604 1604 TCP
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2216
- C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\UPX.exe
  "C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\UPX.exe" --ultra-brute "C:\Users\Admin\Desktop\g.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://darkcomet-rat.com/lounge.dc
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ff9b37346f8,0x7ff9b3734708,0x7ff9b3734718
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3920 /prefetch:8
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff723f05460,0x7ff723f05470,0x7ff723f05480
      4⤵
      PID:324
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3920 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,59294868217980644,15816079997162215559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
    3⤵
    PID:5556

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5372
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:5480

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5752

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5976

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6012

C:\Users\Admin\Desktop\g.exe
"C:\Users\Admin\Desktop\g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3616

C:\Users\Admin\Desktop\g.exe
"C:\Users\Admin\Desktop\g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3424

C:\Users\Admin\Desktop\g.exe
"C:\Users\Admin\Desktop\g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5296

C:\Users\Admin\Desktop\g.exe
"C:\Users\Admin\Desktop\g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196

C:\Users\Admin\Desktop\g.exe
"C:\Users\Admin\Desktop\g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564

C:\Users\Admin\Desktop\dfssdfsdf.exe
"C:\Users\Admin\Desktop\dfssdfsdf.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5632
- C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
  "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1688

C:\Users\Admin\Desktop\dfssdfsdf.exe
"C:\Users\Admin\Desktop\dfssdfsdf.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5760

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5672

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264

C:\Users\Admin\Desktop\g.exe
"C:\Users\Admin\Desktop\g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444

C:\Users\Admin\Desktop\g.exe
"C:\Users\Admin\Desktop\g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5820

C:\Users\Admin\Desktop\g.exe
"C:\Users\Admin\Desktop\g.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\UPX.exe
"C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\UPX.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1176

C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\UPX.exe
"C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\UPX.exe"
1⤵
- Executes dropped EXE
PID:64

C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe
"C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1744
- C:\Users\Admin\AppData\Local\Temp\upnp.exe
  "C:\Users\Admin\AppData\Local\Temp\upnp.exe" -a 10.127.0.205 1604 1604 TCP
  2⤵
  - Executes dropped EXE
  PID:5880

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4440

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5640

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5848

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5440

C:\Users\Admin\Desktop\frsfd.exe
"C:\Users\Admin\Desktop\frsfd.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39191fa5187428284a12dd49cca7e9b9

SHA1
36942ceec06927950e7d19d65dcc6fe31f0834f5

SHA256
60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671

SHA512
a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef84d117d16b3d679146d02ac6e0136b

SHA1
3f6cc16ca6706b43779e84d24da752207030ccb4

SHA256
5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000

SHA512
9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c68b6d9e016f645e1103eb500e5edcec

SHA1
7c68117d50d6cb254771d3d58b98f132f9821af2

SHA256
b92ca641d5d848cbc2cf8ce300ef3c659fc911d84df4aefd0c4049b282b543a0

SHA512
6048c0c1ac24e4a68c264a05d78b950678338f4001582b813b90095fdc344d9e5ee8312dd42c1b360e5836ed3e0f2d699c90683e10df304ae25c334ba725ad18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64e2be967979cb9390af8d5d572abd9d

SHA1
e5f971c1bd3de791ecde354d9709323207405106

SHA256
5dbf48effc0992b2280f3a9bacc0f9274bb69a68ce5549db0521404e9ba070a0

SHA512
1bba86612d158e025cae1817a8bc369b34633cf0c23594f3898f1df265bc83d55611adfdcd0093990d613042d95b50181eec97d5c9ed0dfdcf791aa952ec2eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c4b737fdbcd3e5820985d23bbd58fcac

SHA1
b4eb24e66593b21f2a930c9e343322ac6b110281

SHA256
fc1f757df92bcff1e054c8af495f145d2ba43b06129552e228fc2de73a868b01

SHA512
9269a5fd7d706c580e90ed4afbeaa3bfdaa84195ecd66e451c371bb63f1a4081ef60762867d81b3f569f7eebab6f9272734b90c95285dbdd62870739e520ef75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d4e03097da5cd9e9dff7d0f5ee188d6

SHA1
4dd05e556c49ae5be58509f7c7155dda2dca736d

SHA256
fbe44463ab5369c5f1eea33fcacdeb9c5d30c2784e9f3c986370226731ddfbf9

SHA512
98ddf7e5ab90cf2bcf80af0b30db5c4cdc1ed94b2d2560c0a34a1594e4b07830aaa052e3bbc012e06e3daa93e742738cb4c9fd88d642b0137f4e6866ea4abfed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60d82bd601d64fd00bb0373f5ecd65b8

SHA1
0e8bde426270dfa3ea285c2c5b7282ab37771d4c

SHA256
bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97

SHA512
5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e98d1679e15688ad133f11eee8458ee

SHA1
a4b1a83f0a3f2867954d3146d95d314441950606

SHA256
8aa7eaf918f2969424996a8f3575478006d9d74b308a750f996fe4f5f045554e

SHA512
eb34d52a8df4992444000a93c8d0d11254069b5f43a68a6def21061be03a538f36c42b2e968a8637f12b93235de3140002b0212aa2cdebe0950fd115c04bc72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6d5907779459d7477db85d91c286be45

SHA1
e327f18783d376bd80dfa840ce416402db348655

SHA256
cd511808d5b8eedc4dc9250d4307429aeaff7ea3e7661f60fd4f49999d8c4b86

SHA512
94313a913bfcafc68ddabe73d01acbccc0fc8a0b3581b0ea473932751b77f40ad5ef4ca91e5b242f0f626b7e0617dbb61f5b75ca6b92731f73c667768af097fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4d2a329efd3c60a32e81163aceb30bea

SHA1
50cb812aba64faf3d39a61693d98850b595d7502

SHA256
2963ccc44603e6835023016bbe448369e2abac38d179f504142634d53ec715ec

SHA512
41a1643b26f3e0dae69c4c68d2122b0042b9222058f44c2836701272a454c42c32abbc810e38ed83024a70cb9b09cadde4242474ee5dc469fa499453c6f24d2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d84f3b36e44362f07fe95ed60d36b5bb

SHA1
26e0de358bce1cf586f734e70d4ba6cfc8a58c6d

SHA256
3c0c5c9f27bb3173b806139ad66fcd51badbee73d9557d34940d168f444cc79b

SHA512
166c7bf04829dfbbe9bf49a2919df486d8588f1cab5e748924f314954539129c09414d440374c1c1ac86bc3e24c646e6682fcf72acb0fa826038a614a5086ef8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
855e8d16cbc7404046c6f9bfe54980b0

SHA1
069bd51859ff712aaab99f3428909824cd761de4

SHA256
9fd2d4d5e9c08e02fa89f16a1963dc34f19a3088a54ee02102d09dc3f5f8a83a

SHA512
2b61e38b455d486a712a80a96095bd6c843b4f09cba29b25d7413dccce5e40c07453adfc336d62be67f686467e46580f59d80246cba4713548cf7102d6b0f2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\upnp.exe

Filesize
12KB

MD5
13804f8dc4e72ba103d5e34de895c9db

SHA1
03d7a0500ccb2fef3222ed1eb55f2cbedbb8b8c5

SHA256
da659d8c05cfcb5f0abe167191665359123643000d12140836c28d204294ceb6

SHA512
9abb98795a1b1c142c50c7c110966b4249972de5b1f40445b27d70c3127140b0ddaaada1d92297e96ffd71177b12cd87749953ffdcf6e5da7803b9f9527d7652

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZYL3T41UN9PLRX22F6LQ.temp

Filesize
14KB

MD5
91887a7bdeb7382df23ecf62ae3204e1

SHA1
1a06f5720b7b75ab19961d3543c72fbfecbf4514

SHA256
febeaf5b6539ccd3029bd707b0d4a0e6d85a4ab81a2aaec489d5d7a66e5a413c

SHA512
cdbbbec0f1fcdf3bac0697c800f516a1a5644734d30aebd95b4ab90fc137d1bb94e35c4317540a0f05c8e9c1c7e5453e52b078f503102e39260eb6c237299bee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
9d3cef3ff09c176e555874c1da018ab3

SHA1
df766c0fb0e2c35cd2c69183bc87482e75361641

SHA256
cc384632c90aa578cc3755f0fcd56ffe2e799cde3f9da9f507da1408f04febcd

SHA512
baae8630a3a2f3b180ebc5212b1c68d9c0afb1645235d35310f818a9162665d5513c41d0759e47e5bae54819a6560a5cff334fc1b289de678b02e61d749f2463

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
8cda4085e03452d7e260443688eea9b4

SHA1
9f75c8aae8ed40ad07984b347a26b23c55086edb

SHA256
5002e18db5690fe65154dabe6724abf473412a5d5a4f37c853159af1a2fd2dcc

SHA512
51ac4514b7d070121e8231af5aeb2ad2a9d515b999f2ea767c5e90c8810e95b632fdeb5af3ebd1da91b4179dc0e25ecf5453456c3340b84fbbcf8c8ecb601917

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\AlternateServices.bin

Filesize
8KB

MD5
e1af479e9868310d6b4ba0955731f37d

SHA1
97882adc205659b1f9244cbebd138ae31b1deb04

SHA256
156c7db7c24b6577f2a167d6763c999c855d34bf83ec2c51b2b2c469ca156c48

SHA512
f6551784ac88d3de3bdabfb7f36b5bb21666f4ebc3be0284547c4a1a5119d4869e718baed6fb72599be1eec78bacc08e81d2f2acc1d5a9b9abd01fe58da10177

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\AlternateServices.bin

Filesize
16KB

MD5
d28df5968bae0f962e602f82cf75b0f7

SHA1
219add96d154b5355b6c5e945df701973b65dbfd

SHA256
aa5f76f7d67774c1850d12e5502dcfee96e4689b6498ac06e4fc14c4c398552a

SHA512
4b827b2195641c8ba6df2c09dfa2a849415de3874aa037aa14607df06419f82baa611d9c291b6ba7b3d6c014334b17d19c301628b085bb9da41ff117f663a2c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
341114bf623efe149686a5d5df1393da

SHA1
386967120f07a3f43c31263928d4f20ef930b2d6

SHA256
3e18a6012625e24ea175bf58d97dcbafb482edb3bafe83f0a9fb45f8b9ad693b

SHA512
309e545f263efdb8e0c9e208c3464a795b9805a1c3c1229a0976d01ca3497be4125035f1bbd5ba9425a7ba41f5e9b51e19f85fa6a38c302914aebab225f26af9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
105019e687052a2deeed52b7bfde113b

SHA1
a0a8c18ed6ab0d190afb1db079d5162982cf3b21

SHA256
27f2f08e013fc140e47ae7c273c26fbe1634a8c05d11813a1095515d0ce6e14b

SHA512
9777b1e6b8bce081b4533da2e16a53dcd1ae6371e71f6325a15202ec62dc911b3bd4b6eeb5c61afe460b5b238ade0b2cc1a65d0c30f793ed80c732966f15011c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
9487551b733df153ebd924eae2d89ad9

SHA1
60b305edd86dfef999b75c880c51c7267b023116

SHA256
8440c3fb3a0f4e96edec448d02fddfbbd4cd197d39039dd4e0c47c58898d39b2

SHA512
bab9631d5d40086514d688d147032489c6089c0a37443ebb1eea38ad6c61f05b220c36f119a4b1fa8b667e109a0fd01a3d3094a838150e5f1d92d2f4d36f4277

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\3b6d2272-8fed-4935-af59-e221d23f62a9

Filesize
982B

MD5
7c7212b6436964a024aae0f1110703bf

SHA1
880736f33954ccdbf569508a26c49779d92c01d6

SHA256
85d31a2dec8d409bc239677b511ef2ed31e3bfdb6ddbffac54912a5e1f3e59e0

SHA512
343c9a343a7a7c3a9c7fc8e387da49f8a00988a9f69b064d1cb5b8d447794297163283514ea0ef6d9a2d58759b99a2fd077ddfe3ffd105b1eba844484401ea9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\6b2909cf-c43d-4e40-876c-3d57061390de

Filesize
26KB

MD5
d693ceba7d42e9d6d8ba0f16277bb1c5

SHA1
5b1c5a6e5a3c9e3c0067f070320b1a19b23a023d

SHA256
327812d33b799ce90fcafc6a906810cc46dfae04eee13bc8139711bea3a5857e

SHA512
02c773b463d1cd2a23fedbcd7fb08e4be1c590a0cf785378186e6fc738e445ee2a65c171d6202cc1a59b176ed25a1568fd818164d9fab2a8d3f4e571e047a709

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\datareporting\glean\pending_pings\f4f7f5e8-4f28-4a9f-8bb9-9fc19eec7f7d

Filesize
671B

MD5
ec4d2d67a2cd0d904b34100846d8daf1

SHA1
05c06e9bde05152654416cdf14e985637a2f9bfb

SHA256
74f86a9313b59fc655a782c0fe95213ee0f5fb55aee2f43dd29de5e5a6177f52

SHA512
3b9494a321277fbd559e83b89a4a3c92a3255484eccbe6913a3a1448207f3815dd67d0fcbfc994a6ee31ff47d2f1f0ef41bc706405ea12602edb8b0320d9ec03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\prefs-1.js

Filesize
11KB

MD5
fc8ca4bc5b58430e3016486a72629034

SHA1
a1eb1833765208f815ae1cd4e5621562b65c0ed3

SHA256
5fe9bfbb9e2ced1a1318157b5c4f86c66a5aff5d8203859ecdd8d188a8737770

SHA512
48d49e135c5958821d19d268333ccc1b8a924769bf6f218b2499545b1e4d75ad48eee0b04d5e66282167d45f2ddaa6dc09e9b08eca8f1ce8fb03f04df844086e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\prefs-1.js

Filesize
11KB

MD5
dd9b36ddd841fb5d41592f134d32fd8f

SHA1
017b836bef423a09ae038c9601f621014d77dc06

SHA256
15282f6b78be2c6c77fcfedac9b8ad3e83716c0702258a8b33a1963c6a3c5eb0

SHA512
1916d3f98ed9482262eccb45f913088288240c948104278f879fc4aede0e834f6f9d6916f26d913d97d5f5a9fbab0b72227efa2b1a6b6fdea5bb76c824681cfb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\prefs.js

Filesize
10KB

MD5
3075d9035014075c24ff6285b2b2f9f7

SHA1
40685e1d3a72696e7c2b31434ddf7803d7998fb8

SHA256
7a4dedb2868a509cb1e68be69dffb4a2b0589045ed03fedeccb05f55d5017dd1

SHA512
559f80e11ac472b1bc51e32f3a17a54043b2b5b46989ecf88f6d9ef3eb53a13c64f6d4e123f38eab4682bd1ee3ee6c5d44d17832c787584f14e5e38600bd4454

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\prefs.js

Filesize
12KB

MD5
37ee3d5ea6257198c5366b44ce57b5e2

SHA1
e8e08d31cf4d32a7694d2d0f9a20d4d1b01b4e47

SHA256
6a7c0b74735f6c4b6dd40bb831d75ddbdc944d068b68ad0c33804fc9e48f6ce8

SHA512
c9c5832bb3beec22690d7d365fb3d39683e73a4e6c44c869835dfe6f62db4530726e6e075bdf067d4b2736b89747952265a4e21256116afd4022bceda277a215

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
5d43c12186af34cb92dd450b214e941c

SHA1
8cd164a67e31818ac55fce4b19c95fe380da5009

SHA256
7441faf21c5092d938b5970ef6b7fbb7f87052d81d7234fbd8d3cc88f1977d89

SHA512
81dec854e308c9ba20e8e6c6c8c97461ece42c5661d1d7de490826873f45621b4fb6481b588bf8d3b68025755af1c15e65b4f5df2aa6952bdc17b4508f6d66a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
ac71d46291ed3413ebfaadb4c3501318

SHA1
970d0099d599562e0e877ad2219a529c3f700887

SHA256
9c6de3b3680b405893efad32888693aa947a46605137ea705c0e2fc781183dcd

SHA512
b48a382590247fb61b8f077f4a4bd2e43cdd35d13f0377cd4bca42b76a02099afd72800ff221fcd4d2c9ba6fbc02cae034d3ad0bf9300c52b32310b28b63bcea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
e446f304c1ca4490786c8790236bca9a

SHA1
3f57f6d2577a3dbc341f1388dc740e59c9481e5c

SHA256
eb13ec17c4b6c9c298b9bda3749d2aeb8cca5312c550b1a3d9b331c05193242d

SHA512
9d8457c242a39deb1412c01332f6a951dfd8b0feb3899227348e9eaddfded7408ad722e63165e3f060dcb33e94d58c66522aa17f1d23116ad71a50228e19699c

Download Submit
C:\Users\Admin\Desktop\dfssdfsdf.exe

Filesize
658KB

MD5
51a5d547855d3b714e7751ba9ceb3449

SHA1
3628dce2d98d6a33231b5692ca35ced4b3621b68

SHA256
7a9fd03762fbcbd6c79c9d14d2e51b69ee0cbb04d336b1def87d2f02d724904b

SHA512
1cbf13498b51d03a72795a33fb937350037888b07276972e4109a6a9dee2ab6627bc46c0c231ddd043356a3bbe79b96509a5125f8e04b07f12265e157e2eab9d

Download Submit
C:\Users\Admin\Desktop\frsfd.exe

Filesize
657KB

MD5
34960f869aa933675a70c0c7c17addfe

SHA1
b01ec370b3571d70a2d111f35d5514cc7a18d422

SHA256
9343339fadfe0f62d6fd46c6131ed9fdf01978d817192984e69a8bbecfb406d2

SHA512
5993de154bc0f5db448a243a3d0ec7929e968823b24ae256226e2d8e82f1d50d62977e5a21a2b775cd422416d8656ed0dec103b850a58633b12bec074a4f58d5

Download Submit
C:\Users\Admin\Desktop\g.exe

Filesize
232KB

MD5
093f6d5e98882022d52fcc5ffff98b1c

SHA1
be527f9034c3475c9ee297ef9d09a389bf36c71c

SHA256
d9bd83f2b14c787cd26b78af521871218c077b93e06dde37bf572b920cc18d6b

SHA512
3a4b6923d059f4f05c4c196156cd89f4bef895d68451a6887796b5082a7e1df2e1a0dc255fcebf534c5c7dd241c9b6e12734dc47f3318168ae70709da4368852

Download Submit
C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\UPX.exe

Filesize
283KB

MD5
308f709a8f01371a6dd088a793e65a5f

SHA1
a07c073d807ab0119b090821ee29edaae481e530

SHA256
c0f9faffdf14ab2c853880457be19a237b10f8986755f184ecfe21670076cb35

SHA512
c107f1af768d533d02fb82ae2ed5c126c63b53b11a2e5a5bbf45e396cb7796ca4e7984ce969b487ad38d817f4d4366e7953fb555b279aa019ffb5d1bbba57e28

Download Submit
C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\config.ini

Filesize
530B

MD5
b2d0fcdfeb098c4d006e84dc8fa6f6ca

SHA1
84ec972e534bc678c8236928c297e2d89e8a10c7

SHA256
c6ac91e19cbc80947e21d182dbf0ae9fc882e5a5f0598ad5def9bc76b4a9b52b

SHA512
9664dcd56ed1c80426f01438c1c726952bd8cec1a8ffabd9383f2293aa5e835017c46cae0bfd1a15fa495fb4ce6e050111d47110e3ce088d5a408e5275350a54

Download Submit
C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\config.ini

Filesize
522B

MD5
0a5baccb60ddf613c9ef2b18e0b1863f

SHA1
39bb75213fab1a7b9ab51089ef54f43086d8b1f3

SHA256
21a222e00ea35f663dc6c397c0a0aa6d80e52187644b170cee9e186892a22f4e

SHA512
b24b4e15fc975f81e5e5216cc098f8a34faeb5f7b3f10fe8f9f4a19157abe62f293b4687440434744e5c5284736a9a472fc5d04f5fda72e94fe5e7140b36de9b

Download Submit
C:\Users\Admin\Downloads\DarkComet-RAT-5.iU6TPFfd.3.1-master.zip.part

Filesize
14.6MB

MD5
abef83a4ead4d18c354f98d7e72312f1

SHA1
21e1ce0fa9013534af2a27c6d8fd0798e1028128

SHA256
86ffdda11652f7e00c5fc21eb9f2e97cad4453b5e467501bb1207d3ebb7781ea

SHA512
9145e554f98f8dc66435bd468b6cc064f1f1ea73aafabbb61ec9ed1cb4d6744f22e01f69ac3ed2fd2a3a0c4bb2a50ef658c1d9564f1eaee1848c7f5392742010

Download Submit
\??\pipe\LOCAL\crashpad_2652_DSQZYYBWNPCRPNUG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/64-1193-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download
memory/1176-1190-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download
memory/1564-911-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1564-913-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1688-942-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1688-946-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2216-837-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2216-841-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2264-932-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2444-935-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3220-371-0x000001DA920B0000-0x000001DA92320000-memory.dmp

Filesize
2.4MB

Download
memory/3220-2-0x000001DA920B0000-0x000001DA92320000-memory.dmp

Filesize
2.4MB

Download
memory/3220-266-0x000001DA92090000-0x000001DA92091000-memory.dmp

Filesize
4KB

Download
memory/3220-25-0x000001DA92090000-0x000001DA92091000-memory.dmp

Filesize
4KB

Download
memory/3424-895-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/3616-893-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/4196-899-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/4720-845-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-862-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-900-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-941-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-839-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-909-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-878-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-967-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-970-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-874-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-915-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-872-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-922-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-842-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-1158-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-843-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-844-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-1119-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/4720-852-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/5296-897-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5332-908-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download
memory/5332-888-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download
memory/5332-901-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download
memory/5632-930-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5672-929-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5752-863-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5760-927-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5820-937-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5880-1261-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5892-865-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5916-939-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5944-867-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/5976-869-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/6012-871-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download