darkcomet | 0042904bde2751113928cf97783b2c83918287adb922965385f5a330c810a8ff

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2025, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
Size

2.0MB
MD5

a491b24a3c210e20cb1aa80cc2291955
SHA1

fc288d367fe581e0538a4a20ea4b2c6671ddc29a
SHA256

0042904bde2751113928cf97783b2c83918287adb922965385f5a330c810a8ff
SHA512

62144581ed8a7b0472eb5ffbdb7a77f234a477f8aafa7e54b146ce4be473214d3c674e9c1d42d9da23cbb5693c8049126af9b627655532b01aef02ab29af3509
SSDEEP

49152:hDdiWQUCI9O/BMy3Zbg5gOssSKLiHBxPrp7P2EnDkF:RdiLI9Xy3ZburssS02BxPNqEna

Score

10^/10

darkcomet defense_evasion discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Control Panel\International\Geo\Nation	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Indexer .exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Indexer .exe	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1996	Defrager.exe
5084	Indexer .exe
516	Defrager.exe
3596	Indexer .exe
4828	Defrager.exe
4872	Indexer .exe
4972	Defrager.exe
3304	Indexer .exe
4276	Defrager.exe
3284	Indexer .exe
4528	Defrager.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Software\Wine	Defrager.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Maintener = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Indexer .exe"	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1996	Defrager.exe
516	Defrager.exe
4828	Defrager.exe
4972	Defrager.exe
4276	Defrager.exe
4528	Defrager.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 5084 set thread context of 516	5084	Indexer .exe	109
PID 3596 set thread context of 4828	3596	Indexer .exe	117
PID 4872 set thread context of 4972	4872	Indexer .exe	124
PID 3304 set thread context of 4276	3304	Indexer .exe	130
PID 3284 set thread context of 4528	3284	Indexer .exe	138

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2576	PING.EXE
2372	PING.EXE
3172	PING.EXE
1684	PING.EXE
5020	PING.EXE
4616	PING.EXE

NTFS ADS 28 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_	Indexer .exe
File created	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_	Indexer .exe
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File created	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_	Indexer .exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_	Indexer .exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_	Indexer .exe
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_	Indexer .exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_	Indexer .exe
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_	Indexer .exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_	Indexer .exe
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_	Indexer .exe
File opened for modification	C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe
File opened for modification	C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV	Indexer .exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
2372	PING.EXE
3172	PING.EXE
1684	PING.EXE
5020	PING.EXE
4616	PING.EXE
2576	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
1996	Defrager.exe
1996	Defrager.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
5084	Indexer .exe
516	Defrager.exe
516	Defrager.exe
5084	Indexer .exe
5084	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
3596	Indexer .exe
4828	Defrager.exe
4828	Defrager.exe
3596	Indexer .exe
3596	Indexer .exe
4872	Indexer .exe
4872	Indexer .exe
4872	Indexer .exe
4872	Indexer .exe
4872	Indexer .exe
4872	Indexer .exe
4872	Indexer .exe
4872	Indexer .exe
4872	Indexer .exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
Token: SeIncreaseQuotaPrivilege	1996	Defrager.exe
Token: SeSecurityPrivilege	1996	Defrager.exe
Token: SeTakeOwnershipPrivilege	1996	Defrager.exe
Token: SeLoadDriverPrivilege	1996	Defrager.exe
Token: SeSystemProfilePrivilege	1996	Defrager.exe
Token: SeSystemtimePrivilege	1996	Defrager.exe
Token: SeProfSingleProcessPrivilege	1996	Defrager.exe
Token: SeIncBasePriorityPrivilege	1996	Defrager.exe
Token: SeCreatePagefilePrivilege	1996	Defrager.exe
Token: SeBackupPrivilege	1996	Defrager.exe
Token: SeRestorePrivilege	1996	Defrager.exe
Token: SeShutdownPrivilege	1996	Defrager.exe
Token: SeDebugPrivilege	1996	Defrager.exe
Token: SeSystemEnvironmentPrivilege	1996	Defrager.exe
Token: SeChangeNotifyPrivilege	1996	Defrager.exe
Token: SeRemoteShutdownPrivilege	1996	Defrager.exe
Token: SeUndockPrivilege	1996	Defrager.exe
Token: SeManageVolumePrivilege	1996	Defrager.exe
Token: SeImpersonatePrivilege	1996	Defrager.exe
Token: SeCreateGlobalPrivilege	1996	Defrager.exe
Token: 33	1996	Defrager.exe
Token: 34	1996	Defrager.exe
Token: 35	1996	Defrager.exe
Token: 36	1996	Defrager.exe
Token: SeDebugPrivilege	5084	Indexer .exe
Token: SeIncreaseQuotaPrivilege	516	Defrager.exe
Token: SeSecurityPrivilege	516	Defrager.exe
Token: SeTakeOwnershipPrivilege	516	Defrager.exe
Token: SeLoadDriverPrivilege	516	Defrager.exe
Token: SeSystemProfilePrivilege	516	Defrager.exe
Token: SeSystemtimePrivilege	516	Defrager.exe
Token: SeProfSingleProcessPrivilege	516	Defrager.exe
Token: SeIncBasePriorityPrivilege	516	Defrager.exe
Token: SeCreatePagefilePrivilege	516	Defrager.exe
Token: SeBackupPrivilege	516	Defrager.exe
Token: SeRestorePrivilege	516	Defrager.exe
Token: SeShutdownPrivilege	516	Defrager.exe
Token: SeDebugPrivilege	516	Defrager.exe
Token: SeSystemEnvironmentPrivilege	516	Defrager.exe
Token: SeChangeNotifyPrivilege	516	Defrager.exe
Token: SeRemoteShutdownPrivilege	516	Defrager.exe
Token: SeUndockPrivilege	516	Defrager.exe
Token: SeManageVolumePrivilege	516	Defrager.exe
Token: SeImpersonatePrivilege	516	Defrager.exe
Token: SeCreateGlobalPrivilege	516	Defrager.exe
Token: 33	516	Defrager.exe
Token: 34	516	Defrager.exe
Token: 35	516	Defrager.exe
Token: 36	516	Defrager.exe
Token: SeDebugPrivilege	3596	Indexer .exe
Token: SeIncreaseQuotaPrivilege	4828	Defrager.exe
Token: SeSecurityPrivilege	4828	Defrager.exe
Token: SeTakeOwnershipPrivilege	4828	Defrager.exe
Token: SeLoadDriverPrivilege	4828	Defrager.exe
Token: SeSystemProfilePrivilege	4828	Defrager.exe
Token: SeSystemtimePrivilege	4828	Defrager.exe
Token: SeProfSingleProcessPrivilege	4828	Defrager.exe
Token: SeIncBasePriorityPrivilege	4828	Defrager.exe
Token: SeCreatePagefilePrivilege	4828	Defrager.exe
Token: SeBackupPrivilege	4828	Defrager.exe
Token: SeRestorePrivilege	4828	Defrager.exe
Token: SeShutdownPrivilege	4828	Defrager.exe
Token: SeDebugPrivilege	4828	Defrager.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	Defrager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2264	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	87
PID 2372 wrote to memory of 2264	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	87
PID 2372 wrote to memory of 2264	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	87
PID 2264 wrote to memory of 388	2264	cmd.exe	89
PID 2264 wrote to memory of 388	2264	cmd.exe	89
PID 2264 wrote to memory of 388	2264	cmd.exe	89
PID 2372 wrote to memory of 2364	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	90
PID 2372 wrote to memory of 2364	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	90
PID 2372 wrote to memory of 2364	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	90
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 1996	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	91
PID 2372 wrote to memory of 728	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	92
PID 2372 wrote to memory of 728	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	92
PID 2372 wrote to memory of 728	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	92
PID 2372 wrote to memory of 4400	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	93
PID 2372 wrote to memory of 4400	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	93
PID 2372 wrote to memory of 4400	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	93
PID 388 wrote to memory of 4868	388	wscript.exe	94
PID 388 wrote to memory of 4868	388	wscript.exe	94
PID 388 wrote to memory of 4868	388	wscript.exe	94
PID 2372 wrote to memory of 4796	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	104
PID 2372 wrote to memory of 4796	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	104
PID 2372 wrote to memory of 4796	2372	JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe	104
PID 4796 wrote to memory of 2576	4796	cmd.exe	106
PID 4796 wrote to memory of 2576	4796	cmd.exe	106
PID 4796 wrote to memory of 2576	4796	cmd.exe	106
PID 4796 wrote to memory of 5084	4796	cmd.exe	107
PID 4796 wrote to memory of 5084	4796	cmd.exe	107
PID 4796 wrote to memory of 5084	4796	cmd.exe	107
PID 5084 wrote to memory of 3492	5084	Indexer .exe	108
PID 5084 wrote to memory of 3492	5084	Indexer .exe	108
PID 5084 wrote to memory of 3492	5084	Indexer .exe	108
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 516	5084	Indexer .exe	109
PID 5084 wrote to memory of 4076	5084	Indexer .exe	110
PID 5084 wrote to memory of 4076	5084	Indexer .exe	110
PID 5084 wrote to memory of 4076	5084	Indexer .exe	110
PID 5084 wrote to memory of 264	5084	Indexer .exe	111
PID 5084 wrote to memory of 264	5084	Indexer .exe	111
PID 5084 wrote to memory of 264	5084	Indexer .exe	111
PID 4796 wrote to memory of 2372	4796	cmd.exe	114
PID 4796 wrote to memory of 2372	4796	cmd.exe	114
PID 4796 wrote to memory of 2372	4796	cmd.exe	114
PID 4796 wrote to memory of 3596	4796	cmd.exe	115
PID 4796 wrote to memory of 3596	4796	cmd.exe	115
PID 4796 wrote to memory of 3596	4796	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a491b24a3c210e20cb1aa80cc2291955.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      PID:4868
- C:\Windows\Temp\Defrager.exe
  C:\Windows\Temp\Defrager.exe
  2⤵
  PID:2364
- C:\Windows\Temp\Defrager.exe
  C:\Windows\Temp\Defrager.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1996
- C:\Windows\Temp\Defrager.exe
  C:\Windows\Temp\Defrager.exe
  2⤵
  PID:728
- C:\Windows\Temp\Defrager.exe
  C:\Windows\Temp\Defrager.exe
  2⤵
  PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\per.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 60000
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
    "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:3492
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:516
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:4076
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:264
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 60000
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
    "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3596
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:3748
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4828
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:2156
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:4164
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 60000
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
    "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:4872
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:4952
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:4972
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:1968
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:320
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 60000
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
    "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:3304
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:3892
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:4276
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:1376
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:688
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 60000
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
    "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:3284
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:912
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:4528
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:2648
  - - C:\Windows\Temp\Defrager.exe
      C:\Windows\Temp\Defrager.exe
      4⤵
      PID:4216
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 60000
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV

Filesize
971B

MD5
9c16cb8e3921a67da38d8a8f89d32dcf

SHA1
c2cdb84ec77437f371c6c71f2b1e93b81ece1e0e

SHA256
79fbeca5b4117f57435f7154fb8d49c041156960540055ff6f0331a0b4950fee

SHA512
427a5ef0efaf5ad163a5fc7e0d9d28727e40dd20690c6fb076a4f9717f416e0eaa03ba5006b0096260eaa1b6c3a4709529ef363d549d8fe8186f0810ed736ebe

Download Submit
C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV

Filesize
971B

MD5
f0c0e17beff2da6f63bb0cdcd823d49d

SHA1
79afa5cf686046d55ee7e9af9221ccb5f035f653

SHA256
7aefb433eedebd76391574eab1bcf29be0e72c5041afbca19b36b58d0877c0d2

SHA512
429dd8781c41c5f689498edb8887ae04e1915a19fcdfd964e0b3d980b98f73f9b74dbbb0d4938c7acb23f57cc7ce6457d81edd3bb0a44a8f81d3e38333331dff

Download Submit
C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFPFHRV2E6LTJNFRB9THBX696YTPFSVF7JBCVPJGV

Filesize
971B

MD5
11368cab4796faa9f2181ea78ef85063

SHA1
258fb85bf93fd3f5a4d4b77452830f151e12aea0

SHA256
9e3831d91a13747ffb5be394ab9983b0fa3c18f9f016c7033a39fdaae7961f49

SHA512
68f79ec2f4d99fc24744abc4240b22ac7abc27952dd0a0189843d0e4ce75844bb498110453d3924732cfd034efa546f28e2dc904c194b366a84a146438ef1736

Download Submit
C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0\Data\app.dat

Filesize
971B

MD5
798441ec7e0c37b921c51f6df4f50bde

SHA1
856fac338c2034313a98a6475c5c19319008df79

SHA256
4d9ed88239d70582f6a0cd8b9bcd3d1d458f833d6d978accb3b993d5f3b97739

SHA512
8d35f479b41ffb5d771cc3a1b4f4d9c919c98c65b09145680d2212a4e1dd6354b964c8edb8d6f1d19020ace00d2386b22b4b650753012a0a4570aa5b63320016

Download Submit
C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0\Data\app.dat

Filesize
971B

MD5
a6ed984aeba328e4ef5596adc40bfb7b

SHA1
eeb57d0ad3dd6c58536b4e1ca955ff85d9a381b1

SHA256
7abf014f2c5d1fee2de1ce4ec4a9c74719ea9a12ec20d6ed3535e06a6a505a0d

SHA512
8154018f2694acc5809c2e9b4d5ccc2a449f029053c39596852daf8de97126db934a3be4229fdd5211db2371fe93f78e2a7e6eabe5297105de0a7dcfe5c6f287

Download Submit
C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0\Data\updates.dat

Filesize
971B

MD5
7cda569d903e9892ffc96e6d101e991e

SHA1
58ec3e05605f5e8ee77d00b819cfbc17bbee4a76

SHA256
a6381bfba08666c6eade166ef8a4bf0c88f0a632190d9accf3067c2c8691874c

SHA512
86083f1c21ef9025b10c55a72c6f073cd9f8d761152e9d128c94858cce0bc929543354e7734458e9409686e00c2646377897b94262f0770fb50b88724826c4a2

Download Submit
C:\ProgramData\DYA_MPIHJOQFVWATEPNIL\1.0.0\Data\updates.dat

Filesize
971B

MD5
7f95e96a24545cd7e8bda8512082d20c

SHA1
16a1a14c7fd8f8d7c442cffeedcfaa2266bbedea

SHA256
b7fd9c92e72caed828b41d4f549f5d59b5f5d61d3c1335e381adbcd1f37e0796

SHA512
d0199a804dd812d750d5abba9092389d2e6a668d840c65f703dd61a9ce4ed4555d8c795a33c0bf8d57dbb0864e1d111d31169612003fdfe40223fa8cd4e1e71c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Indexer .exe.log

Filesize
499B

MD5
17f7e5c69c4f1dc984a9810dde3b6982

SHA1
601b5cf990955dabd1693049c2ed13b9ee2d2bd9

SHA256
88f6579fa5ec5ee4040bc0cc74ff0f95966ccfb0181342f51362c42cc10cee12

SHA512
a48162a368d358fe99876d95f0389f07bcbe0f689b741db722d284dbb43dfdeccb0589cc64cb0bad379333bcdbb88c0d3fba7d419572216a219907e2cf501df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Indexer .exe

Filesize
2.0MB

MD5
a491b24a3c210e20cb1aa80cc2291955

SHA1
fc288d367fe581e0538a4a20ea4b2c6671ddc29a

SHA256
0042904bde2751113928cf97783b2c83918287adb922965385f5a330c810a8ff

SHA512
62144581ed8a7b0472eb5ffbdb7a77f234a477f8aafa7e54b146ce4be473214d3c674e9c1d42d9da23cbb5693c8049126af9b627655532b01aef02ab29af3509

Download Submit
C:\Users\Admin\AppData\Local\Temp\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\java.bat

Filesize
47B

MD5
81bf5400486e5da45ba0c6c1399d843f

SHA1
d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d

SHA256
d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1

SHA512
ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

Download Submit
C:\Users\Admin\AppData\Local\Temp\java2.bat

Filesize
149B

MD5
abb26834e1b272333fc2dd0ad0fe5aae

SHA1
c26cc0c5a4e386616f1a1736da70653f6b85e5d9

SHA256
f50fd1abedfb0012b4efa21a43bfc98160ff82549f125a29a34b17f37f22063b

SHA512
3f99312654ac8b8fbc80eb6cecc2d46d0372a4fea64591d671b7c2a3922bcd67d095c4ccd7ae90b8e377c425ac74628aed66b0afc769a9251f7c90efc9d74a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\per.bat

Filesize
111B

MD5
c82ae1b9daef094ac36500bb4648b1d8

SHA1
51b1bfef2998f0ef9ce8ed78877838fac9bfd868

SHA256
0acb99bdf92d3d82f3e34e44c3e7262afc84da3e8bf276fb0d99dc7ac43bd910

SHA512
b66245061790efb3f9c3bacab819537ebe0e4b60a0df3e194b50c543c3176deb5ca847a631a9255fa261e18c78c008421cc89401b1f10708508c2ad1adfee31c

Download Submit
C:\Users\Admin\AppData\Roaming\DYA_MPIHJOQFVWATEPNIL\1.0.0\Data\dya.dat

Filesize
971B

MD5
fc86ffa0ea5c56f7867c4a293a6833ba

SHA1
a08fa33f79ae97fc9081e0edcc46c0b89b3ae1ca

SHA256
68dcc3a792183b43c7fa038f8b21289e6667672e834129278f12dbc375140635

SHA512
7ad93eeef937de4a8d61c96a9016bb05126e39b836c887143f5dcb5850a45cb5991b796310216b0744f1fe0440f575d7db63bca808d18d27b8ba38a535e30724

Download Submit
C:\Users\Admin\AppData\Roaming\DYA_MPIHJOQFVWATEPNIL\1.0.0\Data\dya.dat

Filesize
971B

MD5
e631fb51fad134ed8d5ab02511ed39ae

SHA1
a4b629f488875f540ff99b4734e1f95b7692f785

SHA256
17862555210809b5ffb814a3a7bfafe6da13344ccdc782a6c42af913dc3a53a7

SHA512
95d50929fb1a8a9ec2faf3ee546005fea464f961a328ba9b4860951ba478f4fb8ee2401d403b7332b878d47f285cdba60cb1e241799e325dd28ae76b116039ad

Download Submit
C:\Windows\Temp\Defrager.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/516-178-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-165-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-175-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-179-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-174-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-180-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-181-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-183-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-182-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-163-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-164-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-176-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-168-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-169-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-171-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-177-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-166-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-162-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-173-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-172-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-170-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-167-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/516-222-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-87-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-84-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-102-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-101-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-104-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-105-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-107-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-106-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-110-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-109-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-108-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-69-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-113-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-68-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-115-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-63-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-72-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-100-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-126-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-92-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-99-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-98-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-71-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-73-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-74-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-75-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-86-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-76-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-77-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-78-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-79-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-81-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-82-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-83-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-80-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-88-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-89-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-91-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-90-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-85-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/1996-103-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/2372-46-0x0000000000400000-0x0000000000778000-memory.dmp

Filesize
3.5MB

Download
memory/2372-123-0x00000000006CE000-0x0000000000770000-memory.dmp

Filesize
648KB

Download
memory/2372-114-0x0000000000400000-0x0000000000778000-memory.dmp

Filesize
3.5MB

Download
memory/2372-112-0x00000000006CE000-0x0000000000770000-memory.dmp

Filesize
648KB

Download
memory/2372-49-0x0000000000400000-0x0000000000778000-memory.dmp

Filesize
3.5MB

Download
memory/2372-124-0x0000000000400000-0x0000000000778000-memory.dmp

Filesize
3.5MB

Download
memory/2372-1-0x00000000006CE000-0x0000000000770000-memory.dmp

Filesize
648KB

Download
memory/2372-45-0x0000000000400000-0x0000000000778000-memory.dmp

Filesize
3.5MB

Download
memory/4276-524-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/4276-464-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/4528-624-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/4528-564-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/4828-324-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/4972-363-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download
memory/4972-424-0x0000000000400000-0x000000000065F000-memory.dmp

Filesize
2.4MB

Download