darkcomet | 48163945b7f61883bbef7ce671588278ece93e58a9e5cb9a4385704a53176ad7

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2025, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
Size

4.0MB
MD5

b2e0d4469ee2d14dfdca5ff323b919db
SHA1

ce8c0896c8a3840a2c99ec0877614b7eb14b6665
SHA256

48163945b7f61883bbef7ce671588278ece93e58a9e5cb9a4385704a53176ad7
SHA512

7ee8218f46bc851596ce0538c889ff61d22df243862804d64290171c56e80b67b157c6a8aa7fa24174d40df78223a4968c87f86e95297ce5fe261b3100525103
SSDEEP

98304:rBGCkwq9Y29Me/jRA1+IAt2nNRxnrWiVezIPeOyxom:9GJv1R/dA1NAtKTaiV52Oyim

Score

10^/10

darkcomet defense_evasion discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SA6TSONTOFLASHUNCOMTHEMCR.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Indexer .exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Indexer .exe	cmd.exe

Executes dropped EXE 17 IoCs

pid	Process
944	REIKO 1.EXE
1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE
980	Defrager.exe
368	Indexer .exe
3324	Defrager.exe
4156	Indexer .exe
2988	Defrager.exe
1120	Indexer .exe
4420	Defrager.exe
368	Indexer .exe
3660	Defrager.exe
1596	Indexer .exe
2412	Defrager.exe
4796	Indexer .exe
2868	Defrager.exe
8	Indexer .exe
2856	Defrager.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Defrager.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Maintener = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Indexer .exe"	SA6TSONTOFLASHUNCOMTHEMCR.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
980	Defrager.exe
3324	Defrager.exe
2988	Defrager.exe
4420	Defrager.exe
3660	Defrager.exe
2412	Defrager.exe
2868	Defrager.exe
2856	Defrager.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 368 set thread context of 3324	368	Indexer .exe	98
PID 4156 set thread context of 2988	4156	Indexer .exe	113
PID 1120 set thread context of 4420	1120	Indexer .exe	119
PID 368 set thread context of 3660	368	Indexer .exe	125
PID 1596 set thread context of 2412	1596	Indexer .exe	131
PID 4796 set thread context of 2868	4796	Indexer .exe	137
PID 8 set thread context of 2856	8	Indexer .exe	143

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REIKO 1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SA6TSONTOFLASHUNCOMTHEMCR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3724	PING.EXE
116	PING.EXE
3736	PING.EXE
3084	PING.EXE
2776	PING.EXE
4428	PING.EXE
2972	PING.EXE

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
2776	PING.EXE
4428	PING.EXE
2972	PING.EXE
3724	PING.EXE
116	PING.EXE
3736	PING.EXE
3084	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE
1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE
1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE
1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE
1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE
980	Defrager.exe
980	Defrager.exe
1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE
368	Indexer .exe
368	Indexer .exe
368	Indexer .exe
368	Indexer .exe
368	Indexer .exe
3324	Defrager.exe
3324	Defrager.exe
368	Indexer .exe
4156	Indexer .exe
4156	Indexer .exe
4156	Indexer .exe
4156	Indexer .exe
4156	Indexer .exe
2988	Defrager.exe
2988	Defrager.exe
4156	Indexer .exe
1120	Indexer .exe
1120	Indexer .exe
1120	Indexer .exe
1120	Indexer .exe
1120	Indexer .exe
1120	Indexer .exe
1120	Indexer .exe
1120	Indexer .exe
1120	Indexer .exe
4420	Defrager.exe
4420	Defrager.exe
1120	Indexer .exe
368	Indexer .exe
368	Indexer .exe
368	Indexer .exe
368	Indexer .exe
368	Indexer .exe
3660	Defrager.exe
3660	Defrager.exe
368	Indexer .exe
1596	Indexer .exe
1596	Indexer .exe
1596	Indexer .exe
1596	Indexer .exe
1596	Indexer .exe
2412	Defrager.exe
2412	Defrager.exe
1596	Indexer .exe
4796	Indexer .exe
4796	Indexer .exe
4796	Indexer .exe
4796	Indexer .exe
4796	Indexer .exe
2868	Defrager.exe
2868	Defrager.exe
4796	Indexer .exe
8	Indexer .exe
8	Indexer .exe
8	Indexer .exe
8	Indexer .exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE
Token: SeIncreaseQuotaPrivilege	980	Defrager.exe
Token: SeSecurityPrivilege	980	Defrager.exe
Token: SeTakeOwnershipPrivilege	980	Defrager.exe
Token: SeLoadDriverPrivilege	980	Defrager.exe
Token: SeSystemProfilePrivilege	980	Defrager.exe
Token: SeSystemtimePrivilege	980	Defrager.exe
Token: SeProfSingleProcessPrivilege	980	Defrager.exe
Token: SeIncBasePriorityPrivilege	980	Defrager.exe
Token: SeCreatePagefilePrivilege	980	Defrager.exe
Token: SeBackupPrivilege	980	Defrager.exe
Token: SeRestorePrivilege	980	Defrager.exe
Token: SeShutdownPrivilege	980	Defrager.exe
Token: SeDebugPrivilege	980	Defrager.exe
Token: SeSystemEnvironmentPrivilege	980	Defrager.exe
Token: SeChangeNotifyPrivilege	980	Defrager.exe
Token: SeRemoteShutdownPrivilege	980	Defrager.exe
Token: SeUndockPrivilege	980	Defrager.exe
Token: SeManageVolumePrivilege	980	Defrager.exe
Token: SeImpersonatePrivilege	980	Defrager.exe
Token: SeCreateGlobalPrivilege	980	Defrager.exe
Token: 33	980	Defrager.exe
Token: 34	980	Defrager.exe
Token: 35	980	Defrager.exe
Token: 36	980	Defrager.exe
Token: SeDebugPrivilege	368	Indexer .exe
Token: SeIncreaseQuotaPrivilege	3324	Defrager.exe
Token: SeSecurityPrivilege	3324	Defrager.exe
Token: SeTakeOwnershipPrivilege	3324	Defrager.exe
Token: SeLoadDriverPrivilege	3324	Defrager.exe
Token: SeSystemProfilePrivilege	3324	Defrager.exe
Token: SeSystemtimePrivilege	3324	Defrager.exe
Token: SeProfSingleProcessPrivilege	3324	Defrager.exe
Token: SeIncBasePriorityPrivilege	3324	Defrager.exe
Token: SeCreatePagefilePrivilege	3324	Defrager.exe
Token: SeBackupPrivilege	3324	Defrager.exe
Token: SeRestorePrivilege	3324	Defrager.exe
Token: SeShutdownPrivilege	3324	Defrager.exe
Token: SeDebugPrivilege	3324	Defrager.exe
Token: SeSystemEnvironmentPrivilege	3324	Defrager.exe
Token: SeChangeNotifyPrivilege	3324	Defrager.exe
Token: SeRemoteShutdownPrivilege	3324	Defrager.exe
Token: SeUndockPrivilege	3324	Defrager.exe
Token: SeManageVolumePrivilege	3324	Defrager.exe
Token: SeImpersonatePrivilege	3324	Defrager.exe
Token: SeCreateGlobalPrivilege	3324	Defrager.exe
Token: 33	3324	Defrager.exe
Token: 34	3324	Defrager.exe
Token: 35	3324	Defrager.exe
Token: 36	3324	Defrager.exe
Token: SeDebugPrivilege	4156	Indexer .exe
Token: SeIncreaseQuotaPrivilege	2988	Defrager.exe
Token: SeSecurityPrivilege	2988	Defrager.exe
Token: SeTakeOwnershipPrivilege	2988	Defrager.exe
Token: SeLoadDriverPrivilege	2988	Defrager.exe
Token: SeSystemProfilePrivilege	2988	Defrager.exe
Token: SeSystemtimePrivilege	2988	Defrager.exe
Token: SeProfSingleProcessPrivilege	2988	Defrager.exe
Token: SeIncBasePriorityPrivilege	2988	Defrager.exe
Token: SeCreatePagefilePrivilege	2988	Defrager.exe
Token: SeBackupPrivilege	2988	Defrager.exe
Token: SeRestorePrivilege	2988	Defrager.exe
Token: SeShutdownPrivilege	2988	Defrager.exe
Token: SeDebugPrivilege	2988	Defrager.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1988	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
980	Defrager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 944	1988	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	82
PID 1988 wrote to memory of 944	1988	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	82
PID 1988 wrote to memory of 944	1988	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	82
PID 1988 wrote to memory of 1556	1988	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	83
PID 1988 wrote to memory of 1556	1988	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	83
PID 1988 wrote to memory of 1556	1988	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	83
PID 1556 wrote to memory of 1784	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	84
PID 1556 wrote to memory of 1784	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	84
PID 1556 wrote to memory of 1784	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	84
PID 1784 wrote to memory of 1468	1784	cmd.exe	86
PID 1784 wrote to memory of 1468	1784	cmd.exe	86
PID 1784 wrote to memory of 1468	1784	cmd.exe	86
PID 1556 wrote to memory of 1528	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	87
PID 1556 wrote to memory of 1528	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	87
PID 1556 wrote to memory of 1528	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	87
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 980	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	88
PID 1556 wrote to memory of 3676	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	89
PID 1556 wrote to memory of 3676	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	89
PID 1556 wrote to memory of 3676	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	89
PID 1556 wrote to memory of 3344	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	90
PID 1556 wrote to memory of 3344	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	90
PID 1556 wrote to memory of 3344	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	90
PID 1468 wrote to memory of 1496	1468	wscript.exe	91
PID 1468 wrote to memory of 1496	1468	wscript.exe	91
PID 1468 wrote to memory of 1496	1468	wscript.exe	91
PID 1556 wrote to memory of 2488	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	93
PID 1556 wrote to memory of 2488	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	93
PID 1556 wrote to memory of 2488	1556	SA6TSONTOFLASHUNCOMTHEMCR.EXE	93
PID 2488 wrote to memory of 3724	2488	cmd.exe	95
PID 2488 wrote to memory of 3724	2488	cmd.exe	95
PID 2488 wrote to memory of 3724	2488	cmd.exe	95
PID 2488 wrote to memory of 368	2488	cmd.exe	96
PID 2488 wrote to memory of 368	2488	cmd.exe	96
PID 2488 wrote to memory of 368	2488	cmd.exe	96
PID 368 wrote to memory of 1628	368	Indexer .exe	97
PID 368 wrote to memory of 1628	368	Indexer .exe	97
PID 368 wrote to memory of 1628	368	Indexer .exe	97
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3324	368	Indexer .exe	98
PID 368 wrote to memory of 3900	368	Indexer .exe	99
PID 368 wrote to memory of 3900	368	Indexer .exe	99
PID 368 wrote to memory of 3900	368	Indexer .exe	99
PID 368 wrote to memory of 1440	368	Indexer .exe	100
PID 368 wrote to memory of 1440	368	Indexer .exe	100
PID 368 wrote to memory of 1440	368	Indexer .exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\REIKO 1.EXE
  "C:\Users\Admin\AppData\Local\Temp\REIKO 1.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:944
- C:\Users\Admin\AppData\Local\Temp\SA6TSONTOFLASHUNCOMTHEMCR.EXE
  "C:\Users\Admin\AppData\Local\Temp\SA6TSONTOFLASHUNCOMTHEMCR.EXE"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "
        5⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1496
- - C:\Windows\Temp\Defrager.exe
    C:\Windows\Temp\Defrager.exe
    3⤵
    PID:1528
- - C:\Windows\Temp\Defrager.exe
    C:\Windows\Temp\Defrager.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:980
- - C:\Windows\Temp\Defrager.exe
    C:\Windows\Temp\Defrager.exe
    3⤵
    PID:3676
- - C:\Windows\Temp\Defrager.exe
    C:\Windows\Temp\Defrager.exe
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\per.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:368
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1628
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:3900
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1440
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4156
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1372
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2256
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1996
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1120
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2808
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4420
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:212
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:3852
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:368
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1516
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3660
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1500
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:3636
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1596
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1660
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2412
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2652
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2408
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4796
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:5072
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2868
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:4504
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2140
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:8
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:912
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2856
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:3396
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Indexer .exe.log

Filesize
499B

MD5
13840f563b7e837c7db570b3332833a5

SHA1
dee01a177a63a813d58653908ccccd693f091676

SHA256
333bbd84120abbd26f38f867b6f96265e55bb01dfd111eb0271d88bde3258a60

SHA512
2f53086d5af59806f29902f693614e344fd0f75dc0deed4f8d18c95bfd2542ed7abd17aa60eeb8cde9d5c9f04ad42c4f87e3438eedf70cd8f5449f806e083ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\REIKO 1.EXE

Filesize
1.4MB

MD5
498c38476e0d1394049c362df200f851

SHA1
ead685e3522f82893ec62e98fc927c827471d4e6

SHA256
34ebac4601ebf70369514302ce0deb70866767265a330699eab0995ee5f53aa7

SHA512
c8d2a7a76a18731d315b0873838bdd6739be9f6dc45c3db294cd2716df61e7dbdb8789be592dff5912c373da1635c1014d2b745ccfd2ff040fe5cc1210326bf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\SA6TSONTOFLASHUNCOMTHEMCR.EXE

Filesize
1.9MB

MD5
42536470c192ab0f6e3bde40bfe93c57

SHA1
3ad0bbe73034d48291a4057b824fdc225ace7e4c

SHA256
ba3fdd59aedaea00881145506285e9047e6900322eb0b8a8908c9e150401ee31

SHA512
cc3d2dc1ee2beb60068168e376fd8ead4bfe4930c13d784f012664b6c8b169d9ac6e17aebefd4b44aeab78088831b57e9e85de5d6bd62ad685d6c59ae794a147

Download Submit
C:\Users\Admin\AppData\Local\Temp\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\java.bat

Filesize
47B

MD5
81bf5400486e5da45ba0c6c1399d843f

SHA1
d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d

SHA256
d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1

SHA512
ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

Download Submit
C:\Users\Admin\AppData\Local\Temp\java2.bat

Filesize
149B

MD5
abb26834e1b272333fc2dd0ad0fe5aae

SHA1
c26cc0c5a4e386616f1a1736da70653f6b85e5d9

SHA256
f50fd1abedfb0012b4efa21a43bfc98160ff82549f125a29a34b17f37f22063b

SHA512
3f99312654ac8b8fbc80eb6cecc2d46d0372a4fea64591d671b7c2a3922bcd67d095c4ccd7ae90b8e377c425ac74628aed66b0afc769a9251f7c90efc9d74a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\per.bat

Filesize
111B

MD5
c82ae1b9daef094ac36500bb4648b1d8

SHA1
51b1bfef2998f0ef9ce8ed78877838fac9bfd868

SHA256
0acb99bdf92d3d82f3e34e44c3e7262afc84da3e8bf276fb0d99dc7ac43bd910

SHA512
b66245061790efb3f9c3bacab819537ebe0e4b60a0df3e194b50c543c3176deb5ca847a631a9255fa261e18c78c008421cc89401b1f10708508c2ad1adfee31c

Download Submit
C:\Windows\Temp\Defrager.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/944-20-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/980-63-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-54-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-57-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-60-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-71-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-74-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-75-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-73-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-72-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-70-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-69-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-68-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-67-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-65-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-64-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-94-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-66-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-62-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-59-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-58-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-56-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-43-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-52-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-61-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-55-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-53-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-84-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-82-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-83-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-81-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-86-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-87-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-88-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-85-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-91-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-89-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-90-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-49-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-103-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-46-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/980-95-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1556-27-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Filesize
5.7MB

Download
memory/1556-93-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Filesize
5.7MB

Download
memory/1556-101-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Filesize
5.7MB

Download
memory/1556-92-0x00000000746F2000-0x00000000746F3000-memory.dmp

Filesize
4KB

Download
memory/1556-28-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Filesize
5.7MB

Download
memory/1556-26-0x00000000746F2000-0x00000000746F3000-memory.dmp

Filesize
4KB

Download
memory/1988-0-0x00000000001C0000-0x00000000008D4000-memory.dmp

Filesize
7.1MB

Download
memory/1988-25-0x00000000001C0000-0x00000000008D4000-memory.dmp

Filesize
7.1MB

Download
memory/2412-401-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2412-463-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2856-607-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2856-545-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2868-473-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2868-535-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2988-247-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2988-186-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-131-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-126-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-123-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-122-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-121-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-120-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-119-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-118-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-117-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-116-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-115-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-114-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-173-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-125-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-127-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-128-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-111-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-124-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-129-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-133-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-132-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3324-130-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3660-391-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3660-329-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/4420-319-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/4420-258-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download