Analysis Overview
SHA256
096bac70f86c28b91d8a57ee4352eda89355ad23010b83a893196bc0f9aa5e42
Threat Level: Known bad
The file JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd was found to be: Known bad.
Malicious Activity Summary
Modifies firewall policy service
Darkcomet family
Modifies WinLogon for persistence
Windows security bypass
Darkcomet
Modifies security service
Disables Task Manager via registry modification
Disables RegEdit via registry modification
Checks BIOS information in registry
Adds Run key to start application
Suspicious use of SetThreadContext
System Location Discovery: System Language Discovery
Unsigned PE
System Network Configuration Discovery: Internet Connection Discovery
Runs ping.exe
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-02-27 13:39
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-02-27 13:39
Reported
2025-02-27 13:41
Platform
win7-20240903-en
Max time kernel
149s
Max time network
119s
Command Line
Signatures
Darkcomet
Darkcomet family
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Windows\SysWOW64\explorer.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
Modifies security service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" | C:\Windows\SysWOW64\explorer.exe | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
Disables Task Manager via registry modification
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Windows\SysWOW64\explorer.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2216 set thread context of 2752 | N/A | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe |
| PID 2752 set thread context of 2416 | N/A | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | C:\Windows\SysWOW64\explorer.exe |
| PID 2416 set thread context of 2596 | N/A | C:\Windows\SysWOW64\explorer.exe | C:\Windows\SysWOW64\explorer.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\ping.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\ping.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Windows\SysWOW64\explorer.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier | C:\Windows\SysWOW64\explorer.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\ping.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\explorer.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\explorer.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe"
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe
C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe"
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
Files
memory/2752-2-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2752-6-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-4-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-21-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-20-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-19-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-16-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-15-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-12-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-11-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-9-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-25-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-24-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-23-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2752-22-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2416-33-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/2416-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2416-29-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/2752-39-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2416-35-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/2416-42-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/2596-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2596-62-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2416-64-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/2596-63-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2596-65-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2596-69-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2596-68-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2596-67-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2596-66-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2596-70-0x0000000000400000-0x00000000004B0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2025-02-27 13:39
Reported
2025-02-27 13:41
Platform
win10v2004-20250217-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
Darkcomet
Darkcomet family
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Windows\SysWOW64\explorer.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
Modifies security service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" | C:\Windows\SysWOW64\explorer.exe | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Windows\SysWOW64\explorer.exe | N/A |
Disables Task Manager via registry modification
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Windows\SysWOW64\explorer.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2640 set thread context of 4972 | N/A | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe |
| PID 4972 set thread context of 4404 | N/A | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | C:\Windows\SysWOW64\explorer.exe |
| PID 4404 set thread context of 4816 | N/A | C:\Windows\SysWOW64\explorer.exe | C:\Windows\SysWOW64\explorer.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\ping.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\explorer.exe | N/A |
System Network Configuration Discovery: Internet Connection Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\ping.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier | C:\Windows\SysWOW64\explorer.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\ping.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\explorer.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\explorer.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe"
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe
C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2d949b68f4fde462b7f832505bb4adcd.exe"
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
Network
| Country | Destination | Domain | Proto |
| US | 150.171.27.10:443 | tcp | |
| US | 150.171.27.10:443 | tcp | |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 150.171.27.10:443 | tcp | |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
| US | 8.8.8.8:53 | karakartal.no-ip.info | udp |
Files
memory/4972-2-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4972-3-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4972-4-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4972-6-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4972-5-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4972-7-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4404-11-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/4404-13-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/4972-17-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4816-22-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4404-23-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/4816-24-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4816-25-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4816-26-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4816-29-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4816-28-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4816-27-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4816-30-0x0000000000400000-0x00000000004B0000-memory.dmp