Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-07-2021 08:04
Static task
static1
Behavioral task
behavioral1
Sample
6c6a951636ae4dee7a842c6af1d43236.exe
Resource
win7v20210410
General
-
Target
6c6a951636ae4dee7a842c6af1d43236.exe
-
Size
1.2MB
-
MD5
6c6a951636ae4dee7a842c6af1d43236
-
SHA1
387e2f026ca3ec2a291b09fa76f88fe40ae7007c
-
SHA256
2ebc7cf945c4eba60eb0f25f6b58eb8d7d0558f6b5622530b2b3808987173952
-
SHA512
3324a70e328be9cdbbe60f47da1254208032b73e6b48cbfea9d070b50378a1ed0f6df32b62c3b16712b78ddcaa0b696ee196f8e9448c3b0f025a9f1d36857311
Malware Config
Extracted
darkcomet
ADSAW
secret92.ddns.net:82
DC_MUTEX-TAUBLES
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
4ltiP4nFeytX
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
darknj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" darknj.exe -
Executes dropped EXE 5 IoCs
Processes:
R-Launcher.exedarknj.exeNJ.EXEmsdcsc.exeWindowsServices.exepid process 1852 R-Launcher.exe 1512 darknj.exe 196 NJ.EXE 3548 msdcsc.exe 3724 WindowsServices.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
darknj.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation darknj.exe -
Drops startup file 2 IoCs
Processes:
WindowsServices.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf6e0aafbf214c3565426c44740c8dce.exe WindowsServices.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf6e0aafbf214c3565426c44740c8dce.exe WindowsServices.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
msdcsc.exeWindowsServices.exedarknj.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cf6e0aafbf214c3565426c44740c8dce = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .." WindowsServices.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cf6e0aafbf214c3565426c44740c8dce = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .." WindowsServices.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" darknj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3680 2484 WerFault.exe javaw.exe -
Modifies registry class 1 IoCs
Processes:
darknj.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance darknj.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeNJ.EXEpid process 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 3680 WerFault.exe 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE 196 NJ.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 3548 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
darknj.exeWerFault.exemsdcsc.exeNJ.EXEWindowsServices.exedescription pid process Token: SeIncreaseQuotaPrivilege 1512 darknj.exe Token: SeSecurityPrivilege 1512 darknj.exe Token: SeTakeOwnershipPrivilege 1512 darknj.exe Token: SeLoadDriverPrivilege 1512 darknj.exe Token: SeSystemProfilePrivilege 1512 darknj.exe Token: SeSystemtimePrivilege 1512 darknj.exe Token: SeProfSingleProcessPrivilege 1512 darknj.exe Token: SeIncBasePriorityPrivilege 1512 darknj.exe Token: SeCreatePagefilePrivilege 1512 darknj.exe Token: SeBackupPrivilege 1512 darknj.exe Token: SeRestorePrivilege 1512 darknj.exe Token: SeShutdownPrivilege 1512 darknj.exe Token: SeDebugPrivilege 1512 darknj.exe Token: SeSystemEnvironmentPrivilege 1512 darknj.exe Token: SeChangeNotifyPrivilege 1512 darknj.exe Token: SeRemoteShutdownPrivilege 1512 darknj.exe Token: SeUndockPrivilege 1512 darknj.exe Token: SeManageVolumePrivilege 1512 darknj.exe Token: SeImpersonatePrivilege 1512 darknj.exe Token: SeCreateGlobalPrivilege 1512 darknj.exe Token: 33 1512 darknj.exe Token: 34 1512 darknj.exe Token: 35 1512 darknj.exe Token: 36 1512 darknj.exe Token: SeDebugPrivilege 3680 WerFault.exe Token: SeIncreaseQuotaPrivilege 3548 msdcsc.exe Token: SeSecurityPrivilege 3548 msdcsc.exe Token: SeTakeOwnershipPrivilege 3548 msdcsc.exe Token: SeLoadDriverPrivilege 3548 msdcsc.exe Token: SeSystemProfilePrivilege 3548 msdcsc.exe Token: SeSystemtimePrivilege 3548 msdcsc.exe Token: SeProfSingleProcessPrivilege 3548 msdcsc.exe Token: SeIncBasePriorityPrivilege 3548 msdcsc.exe Token: SeCreatePagefilePrivilege 3548 msdcsc.exe Token: SeBackupPrivilege 3548 msdcsc.exe Token: SeRestorePrivilege 3548 msdcsc.exe Token: SeShutdownPrivilege 3548 msdcsc.exe Token: SeDebugPrivilege 3548 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3548 msdcsc.exe Token: SeChangeNotifyPrivilege 3548 msdcsc.exe Token: SeRemoteShutdownPrivilege 3548 msdcsc.exe Token: SeUndockPrivilege 3548 msdcsc.exe Token: SeManageVolumePrivilege 3548 msdcsc.exe Token: SeImpersonatePrivilege 3548 msdcsc.exe Token: SeCreateGlobalPrivilege 3548 msdcsc.exe Token: 33 3548 msdcsc.exe Token: 34 3548 msdcsc.exe Token: 35 3548 msdcsc.exe Token: 36 3548 msdcsc.exe Token: SeDebugPrivilege 196 NJ.EXE Token: SeDebugPrivilege 3724 WindowsServices.exe Token: 33 3724 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3724 WindowsServices.exe Token: 33 3724 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3724 WindowsServices.exe Token: 33 3724 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3724 WindowsServices.exe Token: 33 3724 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3724 WindowsServices.exe Token: 33 3724 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3724 WindowsServices.exe Token: 33 3724 WindowsServices.exe Token: SeIncBasePriorityPrivilege 3724 WindowsServices.exe Token: 33 3724 WindowsServices.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 3548 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exedarknj.execmd.execmd.exemsdcsc.exedescription pid process target process PID 656 wrote to memory of 1852 656 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 656 wrote to memory of 1852 656 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 656 wrote to memory of 1852 656 6c6a951636ae4dee7a842c6af1d43236.exe R-Launcher.exe PID 656 wrote to memory of 1512 656 6c6a951636ae4dee7a842c6af1d43236.exe darknj.exe PID 656 wrote to memory of 1512 656 6c6a951636ae4dee7a842c6af1d43236.exe darknj.exe PID 656 wrote to memory of 1512 656 6c6a951636ae4dee7a842c6af1d43236.exe darknj.exe PID 1852 wrote to memory of 2484 1852 R-Launcher.exe javaw.exe PID 1852 wrote to memory of 2484 1852 R-Launcher.exe javaw.exe PID 1512 wrote to memory of 3120 1512 darknj.exe cmd.exe PID 1512 wrote to memory of 3120 1512 darknj.exe cmd.exe PID 1512 wrote to memory of 3120 1512 darknj.exe cmd.exe PID 1512 wrote to memory of 2824 1512 darknj.exe cmd.exe PID 1512 wrote to memory of 2824 1512 darknj.exe cmd.exe PID 1512 wrote to memory of 2824 1512 darknj.exe cmd.exe PID 1512 wrote to memory of 196 1512 darknj.exe NJ.EXE PID 1512 wrote to memory of 196 1512 darknj.exe NJ.EXE PID 1512 wrote to memory of 196 1512 darknj.exe NJ.EXE PID 3120 wrote to memory of 956 3120 cmd.exe attrib.exe PID 3120 wrote to memory of 956 3120 cmd.exe attrib.exe PID 3120 wrote to memory of 956 3120 cmd.exe attrib.exe PID 2824 wrote to memory of 2872 2824 cmd.exe attrib.exe PID 2824 wrote to memory of 2872 2824 cmd.exe attrib.exe PID 2824 wrote to memory of 2872 2824 cmd.exe attrib.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3940 1512 darknj.exe notepad.exe PID 1512 wrote to memory of 3548 1512 darknj.exe msdcsc.exe PID 1512 wrote to memory of 3548 1512 darknj.exe msdcsc.exe PID 1512 wrote to memory of 3548 1512 darknj.exe msdcsc.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe PID 3548 wrote to memory of 1360 3548 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2872 attrib.exe 956 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c6a951636ae4dee7a842c6af1d43236.exe"C:\Users\Admin\AppData\Local\Temp\6c6a951636ae4dee7a842c6af1d43236.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2484 -s 3564⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\darknj.exe"C:\Users\Admin\AppData\Local\Temp\darknj.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXE"C:\Users\Admin\AppData\Local\Temp\NJ.EXE"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\WindowsServices.exe"C:\Users\Admin\AppData\Roaming\WindowsServices.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\WindowsServices.exe" "WindowsServices.exe" ENABLE5⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
C:\Users\Admin\AppData\Local\Temp\NJ.EXEMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
C:\Users\Admin\AppData\Local\Temp\R-Launcher.exeMD5
f09f583748cb26682f60279b8bba14c8
SHA1caf750a85d3abd708c080ebfa995bc2cc0b4cafd
SHA2567f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc
SHA512cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9
-
C:\Users\Admin\AppData\Local\Temp\R-Launcher.exeMD5
f09f583748cb26682f60279b8bba14c8
SHA1caf750a85d3abd708c080ebfa995bc2cc0b4cafd
SHA2567f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc
SHA512cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9
-
C:\Users\Admin\AppData\Local\Temp\darknj.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
C:\Users\Admin\AppData\Local\Temp\darknj.exeMD5
b0fe10b99dd5f8494e7c71b8fda9239b
SHA1e93f7447408e10424ea3f4b3a92473e125d2af6b
SHA256121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536
SHA5126c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518
-
C:\Users\Admin\AppData\Roaming\WindowsServices.exeMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
C:\Users\Admin\AppData\Roaming\WindowsServices.exeMD5
d3b0deb25e223b27361f1024bdbcba0c
SHA18e250d9ea3abf31f589005d9406eb6850a2a02b6
SHA256ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d
SHA512d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d
-
memory/196-124-0x0000000000000000-mapping.dmp
-
memory/196-130-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/956-127-0x0000000000000000-mapping.dmp
-
memory/1360-137-0x0000000003050000-0x0000000003051000-memory.dmpFilesize
4KB
-
memory/1360-135-0x0000000000000000-mapping.dmp
-
memory/1512-121-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/1512-116-0x0000000000000000-mapping.dmp
-
memory/1836-142-0x0000000000000000-mapping.dmp
-
memory/1852-114-0x0000000000000000-mapping.dmp
-
memory/2484-120-0x0000000000000000-mapping.dmp
-
memory/2824-123-0x0000000000000000-mapping.dmp
-
memory/2872-128-0x0000000000000000-mapping.dmp
-
memory/3120-122-0x0000000000000000-mapping.dmp
-
memory/3548-136-0x0000000000590000-0x000000000063E000-memory.dmpFilesize
696KB
-
memory/3548-132-0x0000000000000000-mapping.dmp
-
memory/3724-138-0x0000000000000000-mapping.dmp
-
memory/3724-141-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/3940-131-0x0000000002E40000-0x0000000002E41000-memory.dmpFilesize
4KB
-
memory/3940-129-0x0000000000000000-mapping.dmp