Analysis
-
max time kernel
133s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2022 09:28
Behavioral task
behavioral1
Sample
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe
Resource
win7-20220715-en
Errors
General
-
Target
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe
-
Size
349KB
-
MD5
a95e3e4dbedcc98e826cc682ef8b3fd6
-
SHA1
54008e19ea4b5b4a452905fa5f7d78b3ecfbfe6e
-
SHA256
6aaa5a53455217ab61faeb5f0f57fb643f594af50ae613275db528119e3f3715
-
SHA512
b73e4c4834e0b9de45c0efa8d589264e06b5f858bd393732fde1813c0d64ccc5e054625eaad5dd054f15d34e529d30a5505f84443e749640c5d68b00a8c4c4f5
Malware Config
Extracted
darkcomet
22
kvejo991.ddns.net:1604
DC_MUTEX-B50G4BJ
-
InstallPath
MSDCSC\explorer.exe
-
gencode
JLac09ou37rj
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
explorer
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\explorer.exe" 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" explorer.exe -
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 1464 explorer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2392 attrib.exe 1472 attrib.exe -
Processes:
resource yara_rule behavioral2/memory/4904-130-0x0000000000400000-0x00000000004E8000-memory.dmp upx C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exe upx C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exe upx behavioral2/memory/4904-140-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral2/memory/1464-141-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral2/memory/1464-144-0x0000000000400000-0x00000000004E8000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe -
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exe6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\explorer.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\explorer.exe" 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exedescription ioc process File opened (read-only) \??\V: explorer.exe File opened (read-only) \??\W: explorer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\I: explorer.exe File opened (read-only) \??\N: explorer.exe File opened (read-only) \??\O: explorer.exe File opened (read-only) \??\P: explorer.exe File opened (read-only) \??\R: explorer.exe File opened (read-only) \??\S: explorer.exe File opened (read-only) \??\T: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\L: explorer.exe File opened (read-only) \??\M: explorer.exe File opened (read-only) \??\X: explorer.exe File opened (read-only) \??\Z: explorer.exe File opened (read-only) \??\B: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\J: explorer.exe File opened (read-only) \??\K: explorer.exe File opened (read-only) \??\Q: explorer.exe File opened (read-only) \??\U: explorer.exe File opened (read-only) \??\Y: explorer.exe File opened (read-only) \??\A: explorer.exe File opened (read-only) \??\H: explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "92" LogonUI.exe -
Modifies registry class 1 IoCs
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exeexplorer.exeshutdown.exedescription pid process Token: SeIncreaseQuotaPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeSecurityPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeTakeOwnershipPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeLoadDriverPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeSystemProfilePrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeSystemtimePrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeProfSingleProcessPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeIncBasePriorityPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeCreatePagefilePrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeBackupPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeRestorePrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeShutdownPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeDebugPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeSystemEnvironmentPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeChangeNotifyPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeRemoteShutdownPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeUndockPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeManageVolumePrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeImpersonatePrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeCreateGlobalPrivilege 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: 33 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: 34 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: 35 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: 36 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeIncreaseQuotaPrivilege 1464 explorer.exe Token: SeSecurityPrivilege 1464 explorer.exe Token: SeTakeOwnershipPrivilege 1464 explorer.exe Token: SeLoadDriverPrivilege 1464 explorer.exe Token: SeSystemProfilePrivilege 1464 explorer.exe Token: SeSystemtimePrivilege 1464 explorer.exe Token: SeProfSingleProcessPrivilege 1464 explorer.exe Token: SeIncBasePriorityPrivilege 1464 explorer.exe Token: SeCreatePagefilePrivilege 1464 explorer.exe Token: SeBackupPrivilege 1464 explorer.exe Token: SeRestorePrivilege 1464 explorer.exe Token: SeShutdownPrivilege 1464 explorer.exe Token: SeDebugPrivilege 1464 explorer.exe Token: SeSystemEnvironmentPrivilege 1464 explorer.exe Token: SeChangeNotifyPrivilege 1464 explorer.exe Token: SeRemoteShutdownPrivilege 1464 explorer.exe Token: SeUndockPrivilege 1464 explorer.exe Token: SeManageVolumePrivilege 1464 explorer.exe Token: SeImpersonatePrivilege 1464 explorer.exe Token: SeCreateGlobalPrivilege 1464 explorer.exe Token: 33 1464 explorer.exe Token: 34 1464 explorer.exe Token: 35 1464 explorer.exe Token: 36 1464 explorer.exe Token: SeShutdownPrivilege 3708 shutdown.exe Token: SeRemoteShutdownPrivilege 3708 shutdown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
explorer.exeLogonUI.exepid process 1464 explorer.exe 1608 LogonUI.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.execmd.execmd.exeexplorer.execmd.exedescription pid process target process PID 4904 wrote to memory of 4268 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 4904 wrote to memory of 4268 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 4904 wrote to memory of 4268 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 4904 wrote to memory of 4680 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 4904 wrote to memory of 4680 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 4904 wrote to memory of 4680 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4904 wrote to memory of 2740 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 4268 wrote to memory of 2392 4268 cmd.exe attrib.exe PID 4268 wrote to memory of 2392 4268 cmd.exe attrib.exe PID 4268 wrote to memory of 2392 4268 cmd.exe attrib.exe PID 4680 wrote to memory of 1472 4680 cmd.exe attrib.exe PID 4680 wrote to memory of 1472 4680 cmd.exe attrib.exe PID 4680 wrote to memory of 1472 4680 cmd.exe attrib.exe PID 4904 wrote to memory of 1464 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe explorer.exe PID 4904 wrote to memory of 1464 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe explorer.exe PID 4904 wrote to memory of 1464 4904 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe explorer.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 1284 1464 explorer.exe notepad.exe PID 1464 wrote to memory of 3784 1464 explorer.exe cmd.exe PID 1464 wrote to memory of 3784 1464 explorer.exe cmd.exe PID 1464 wrote to memory of 3784 1464 explorer.exe cmd.exe PID 3784 wrote to memory of 3708 3784 cmd.exe shutdown.exe PID 3784 wrote to memory of 3708 3784 cmd.exe shutdown.exe PID 3784 wrote to memory of 3708 3784 cmd.exe shutdown.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2392 attrib.exe 1472 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe"C:\Users\Admin\AppData\Local\Temp\6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exe"C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shutdown.exeshutdown -s4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39e1055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Winlogon Helper DLL
1Modify Existing Service
2Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
6Disabling Security Tools
2Hidden Files and Directories
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exeFilesize
349KB
MD5a95e3e4dbedcc98e826cc682ef8b3fd6
SHA154008e19ea4b5b4a452905fa5f7d78b3ecfbfe6e
SHA2566aaa5a53455217ab61faeb5f0f57fb643f594af50ae613275db528119e3f3715
SHA512b73e4c4834e0b9de45c0efa8d589264e06b5f858bd393732fde1813c0d64ccc5e054625eaad5dd054f15d34e529d30a5505f84443e749640c5d68b00a8c4c4f5
-
C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exeFilesize
349KB
MD5a95e3e4dbedcc98e826cc682ef8b3fd6
SHA154008e19ea4b5b4a452905fa5f7d78b3ecfbfe6e
SHA2566aaa5a53455217ab61faeb5f0f57fb643f594af50ae613275db528119e3f3715
SHA512b73e4c4834e0b9de45c0efa8d589264e06b5f858bd393732fde1813c0d64ccc5e054625eaad5dd054f15d34e529d30a5505f84443e749640c5d68b00a8c4c4f5
-
memory/1284-139-0x0000000000000000-mapping.dmp
-
memory/1464-136-0x0000000000000000-mapping.dmp
-
memory/1464-141-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/1464-144-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/1472-135-0x0000000000000000-mapping.dmp
-
memory/2392-134-0x0000000000000000-mapping.dmp
-
memory/2740-133-0x0000000000000000-mapping.dmp
-
memory/3708-143-0x0000000000000000-mapping.dmp
-
memory/3784-142-0x0000000000000000-mapping.dmp
-
memory/4268-131-0x0000000000000000-mapping.dmp
-
memory/4680-132-0x0000000000000000-mapping.dmp
-
memory/4904-130-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/4904-140-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB