Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 17:03
Behavioral task
behavioral1
Sample
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe
Resource
win7-20240221-en
General
-
Target
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe
-
Size
975KB
-
MD5
af7484c40877c3d74d58100509797f71
-
SHA1
70cd03800362f1b35dc5260642ebf7d2159f18b8
-
SHA256
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86
-
SHA512
b964f8277222df462ffd60b321ce856bdc4956234171bd8ea57dff4adfa02a07d0101e52eb5e5db5684a5b3f56b6ec67cadb10db9fb87b8d51affe8cba9220e1
-
SSDEEP
12288:W9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hlx3st:yZ1xuVVjfFoynPaVBUR8f+kN10EBDBst
Malware Config
Extracted
darkcomet
Guest16
nakaga.ddns.net:1604
DC_MUTEX-4A2S168
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
pkmsYsbr22Ni
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3064 attrib.exe 2524 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2920 notepad.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2400 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exepid process 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msdcsc.exe001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 2400 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeSecurityPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeTakeOwnershipPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeLoadDriverPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeSystemProfilePrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeSystemtimePrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeProfSingleProcessPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeIncBasePriorityPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeCreatePagefilePrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeBackupPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeRestorePrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeShutdownPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeDebugPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeSystemEnvironmentPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeChangeNotifyPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeRemoteShutdownPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeUndockPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeManageVolumePrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeImpersonatePrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeCreateGlobalPrivilege 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: 33 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: 34 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: 35 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeIncreaseQuotaPrivilege 2400 msdcsc.exe Token: SeSecurityPrivilege 2400 msdcsc.exe Token: SeTakeOwnershipPrivilege 2400 msdcsc.exe Token: SeLoadDriverPrivilege 2400 msdcsc.exe Token: SeSystemProfilePrivilege 2400 msdcsc.exe Token: SeSystemtimePrivilege 2400 msdcsc.exe Token: SeProfSingleProcessPrivilege 2400 msdcsc.exe Token: SeIncBasePriorityPrivilege 2400 msdcsc.exe Token: SeCreatePagefilePrivilege 2400 msdcsc.exe Token: SeBackupPrivilege 2400 msdcsc.exe Token: SeRestorePrivilege 2400 msdcsc.exe Token: SeShutdownPrivilege 2400 msdcsc.exe Token: SeDebugPrivilege 2400 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2400 msdcsc.exe Token: SeChangeNotifyPrivilege 2400 msdcsc.exe Token: SeRemoteShutdownPrivilege 2400 msdcsc.exe Token: SeUndockPrivilege 2400 msdcsc.exe Token: SeManageVolumePrivilege 2400 msdcsc.exe Token: SeImpersonatePrivilege 2400 msdcsc.exe Token: SeCreateGlobalPrivilege 2400 msdcsc.exe Token: 33 2400 msdcsc.exe Token: 34 2400 msdcsc.exe Token: 35 2400 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 2400 msdcsc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1708 wrote to memory of 3028 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1708 wrote to memory of 3028 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1708 wrote to memory of 3028 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1708 wrote to memory of 3028 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1708 wrote to memory of 2844 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1708 wrote to memory of 2844 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1708 wrote to memory of 2844 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1708 wrote to memory of 2844 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 3028 wrote to memory of 3064 3028 cmd.exe attrib.exe PID 3028 wrote to memory of 3064 3028 cmd.exe attrib.exe PID 3028 wrote to memory of 3064 3028 cmd.exe attrib.exe PID 3028 wrote to memory of 3064 3028 cmd.exe attrib.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 2844 wrote to memory of 2524 2844 cmd.exe attrib.exe PID 2844 wrote to memory of 2524 2844 cmd.exe attrib.exe PID 2844 wrote to memory of 2524 2844 cmd.exe attrib.exe PID 2844 wrote to memory of 2524 2844 cmd.exe attrib.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2920 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1708 wrote to memory of 2400 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe msdcsc.exe PID 1708 wrote to memory of 2400 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe msdcsc.exe PID 1708 wrote to memory of 2400 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe msdcsc.exe PID 1708 wrote to memory of 2400 1708 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe msdcsc.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe PID 2400 wrote to memory of 2388 2400 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2524 attrib.exe 3064 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe"C:\Users\Admin\AppData\Local\Temp\001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
704KB
MD5364b5d43fbd86a37afe2558f6fde918c
SHA113b06934374707cded7340d24d263de86b578d08
SHA2562c211615de3f42a20a744db0261f96059bd579589e399f5efa83d5d1d249244e
SHA512d9fc91363e690b3493a27deb4de51212a5ba8b5c6bfb147b7b9b42dd4d1688572c4c03d4e80eae5e8dc3de30bded813ce8e2ff87465366b2ae3eb824f46813e0
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
512KB
MD5747172d60c520ddd93eb2f5ca6f63839
SHA1d5972b9a6157596c53ffc53115c164db3cbc36ce
SHA2567c7036768f9744773b95e6e3ffdad3b58a2efddd47dd9ff42d266cb225a4a83f
SHA51232e85c52ba96892bb3b0250dbe78b006ab2ed258d3c6c14d721e9e69321b02510cce6574396d844568f86e2a248a744bddfc6f331cadaab752c6dbe0ae08a8af
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
975KB
MD5af7484c40877c3d74d58100509797f71
SHA170cd03800362f1b35dc5260642ebf7d2159f18b8
SHA256001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86
SHA512b964f8277222df462ffd60b321ce856bdc4956234171bd8ea57dff4adfa02a07d0101e52eb5e5db5684a5b3f56b6ec67cadb10db9fb87b8d51affe8cba9220e1
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
64KB
MD564801e5c05eda847c6488a2b59445d1d
SHA13a96b8a71afc35c7ea6fae9d7bc375fbd14571af
SHA2560ab158a8a4174f782736abafac756ca3dbff767332058279be357b1afa7b6d61
SHA512fa2060b7585965fc5ae76a44e4358ca1018d070e3142ed903926e54bfac030e924f8b8996602c1caa3ed1a1cc09aaa23858617bdba14a023a91451fa63a23f16
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
640KB
MD55b20d3dc2efe522a1707454a19ea5d04
SHA1b57a8afac278566e8546e69317655b660c82c07f
SHA256a67c6362fe60aa956d925b4c22513d1ab239933eeeb5e455ab5d428c15881b32
SHA5127efe558301cc54147aa65c24ad5b54cfad4d4fdccd5fc5cf9ead2f9b7f168cfc058c65c5e1b92e6fcceb53e9aa010a081dab00c8c07ddef6e38f75d456d38fa6
-
memory/1708-0-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1708-70-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/2388-69-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2400-37-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2400-72-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/2400-73-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/2400-74-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/2400-75-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/2400-76-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/2400-77-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/2920-28-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/2920-4-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB