darkcomet | 273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
15-11-2020 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe
Size

1.8MB
MD5

9dac373d8e40e65460db0238cb110473
SHA1

240d9a67dbb28122beb4569a3fe04788459d5628
SHA256

273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd
SHA512

47f593b674ef732eabe676f569c51764ea73f60778cb033bd0cf92830e44d51bb6e08f319c9de04ad65abb39d807bc3fda5d93313db6424c9393ce64dd9f4a96

Score

10^/10

darkcomet vbsted evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

vbsted

forshared.ddns.net:6722

Mutex

DC_MUTEX-6UPV0L8

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
kWdnrSvNCdV5
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	RegSvcs.exe

Executes dropped EXE 5 IoCs

Processes:

kngmpwequb.pifRegSvcs.exemsdcsc.exekngmpwequb.pifRegSvcs.exe

pid process

1188 kngmpwequb.pif
1664 RegSvcs.exe
1780 msdcsc.exe
1508 kngmpwequb.pif
1924 RegSvcs.exe

Loads dropped DLL 7 IoCs

Processes:

273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exekngmpwequb.pifRegSvcs.exekngmpwequb.pif

pid	process
1644	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe
1644	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe
1644	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe
1644	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe
1188	kngmpwequb.pif
1664	RegSvcs.exe
1508	kngmpwequb.pif

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exekngmpwequb.pifkngmpwequb.pif

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	RegSvcs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	kngmpwequb.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vbsted = "c:\\33725277\\KNGMPW~1.PIF c:\\33725277\\XPOMRF~1.RQN"	kngmpwequb.pif
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	kngmpwequb.pif
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vbsted = "c:\\33725277\\KNGMPW~1.PIF c:\\33725277\\XPOMRF~1.RQN"	kngmpwequb.pif

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

kngmpwequb.pifkngmpwequb.pif

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kngmpwequb.pif
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kngmpwequb.pif

Suspicious use of SetThreadContext 2 IoCs

Processes:

kngmpwequb.pifkngmpwequb.pif

description	pid	process	target process
PID 1188 set thread context of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1508 set thread context of 1924	1508	kngmpwequb.pif	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

kngmpwequb.pifkngmpwequb.pif

pid	process
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1188	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif
1508	kngmpwequb.pif

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

RegSvcs.exeRegSvcs.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1664	RegSvcs.exe
Token: SeSecurityPrivilege	1664	RegSvcs.exe
Token: SeTakeOwnershipPrivilege	1664	RegSvcs.exe
Token: SeLoadDriverPrivilege	1664	RegSvcs.exe
Token: SeSystemProfilePrivilege	1664	RegSvcs.exe
Token: SeSystemtimePrivilege	1664	RegSvcs.exe
Token: SeProfSingleProcessPrivilege	1664	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1664	RegSvcs.exe
Token: SeCreatePagefilePrivilege	1664	RegSvcs.exe
Token: SeBackupPrivilege	1664	RegSvcs.exe
Token: SeRestorePrivilege	1664	RegSvcs.exe
Token: SeShutdownPrivilege	1664	RegSvcs.exe
Token: SeDebugPrivilege	1664	RegSvcs.exe
Token: SeSystemEnvironmentPrivilege	1664	RegSvcs.exe
Token: SeChangeNotifyPrivilege	1664	RegSvcs.exe
Token: SeRemoteShutdownPrivilege	1664	RegSvcs.exe
Token: SeUndockPrivilege	1664	RegSvcs.exe
Token: SeManageVolumePrivilege	1664	RegSvcs.exe
Token: SeImpersonatePrivilege	1664	RegSvcs.exe
Token: SeCreateGlobalPrivilege	1664	RegSvcs.exe
Token: 33	1664	RegSvcs.exe
Token: 34	1664	RegSvcs.exe
Token: 35	1664	RegSvcs.exe
Token: SeIncreaseQuotaPrivilege	1924	RegSvcs.exe
Token: SeSecurityPrivilege	1924	RegSvcs.exe
Token: SeTakeOwnershipPrivilege	1924	RegSvcs.exe
Token: SeLoadDriverPrivilege	1924	RegSvcs.exe
Token: SeSystemProfilePrivilege	1924	RegSvcs.exe
Token: SeSystemtimePrivilege	1924	RegSvcs.exe
Token: SeProfSingleProcessPrivilege	1924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1924	RegSvcs.exe
Token: SeCreatePagefilePrivilege	1924	RegSvcs.exe
Token: SeBackupPrivilege	1924	RegSvcs.exe
Token: SeRestorePrivilege	1924	RegSvcs.exe
Token: SeShutdownPrivilege	1924	RegSvcs.exe
Token: SeDebugPrivilege	1924	RegSvcs.exe
Token: SeSystemEnvironmentPrivilege	1924	RegSvcs.exe
Token: SeChangeNotifyPrivilege	1924	RegSvcs.exe
Token: SeRemoteShutdownPrivilege	1924	RegSvcs.exe
Token: SeUndockPrivilege	1924	RegSvcs.exe
Token: SeManageVolumePrivilege	1924	RegSvcs.exe
Token: SeImpersonatePrivilege	1924	RegSvcs.exe
Token: SeCreateGlobalPrivilege	1924	RegSvcs.exe
Token: 33	1924	RegSvcs.exe
Token: 34	1924	RegSvcs.exe
Token: 35	1924	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1924 RegSvcs.exe

pid	process
1924	RegSvcs.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exekngmpwequb.pifRegSvcs.exeWScript.exekngmpwequb.pif

description	pid	process	target process
PID 1644 wrote to memory of 1188	1644	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe	kngmpwequb.pif
PID 1644 wrote to memory of 1188	1644	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe	kngmpwequb.pif
PID 1644 wrote to memory of 1188	1644	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe	kngmpwequb.pif
PID 1644 wrote to memory of 1188	1644	273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe	kngmpwequb.pif
PID 1188 wrote to memory of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1188 wrote to memory of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1188 wrote to memory of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1188 wrote to memory of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1188 wrote to memory of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1188 wrote to memory of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1188 wrote to memory of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1188 wrote to memory of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1188 wrote to memory of 1664	1188	kngmpwequb.pif	RegSvcs.exe
PID 1664 wrote to memory of 1780	1664	RegSvcs.exe	msdcsc.exe
PID 1664 wrote to memory of 1780	1664	RegSvcs.exe	msdcsc.exe
PID 1664 wrote to memory of 1780	1664	RegSvcs.exe	msdcsc.exe
PID 1664 wrote to memory of 1780	1664	RegSvcs.exe	msdcsc.exe
PID 1664 wrote to memory of 1780	1664	RegSvcs.exe	msdcsc.exe
PID 1664 wrote to memory of 1780	1664	RegSvcs.exe	msdcsc.exe
PID 1664 wrote to memory of 1780	1664	RegSvcs.exe	msdcsc.exe
PID 1188 wrote to memory of 964	1188	kngmpwequb.pif	WScript.exe
PID 1188 wrote to memory of 964	1188	kngmpwequb.pif	WScript.exe
PID 1188 wrote to memory of 964	1188	kngmpwequb.pif	WScript.exe
PID 1188 wrote to memory of 964	1188	kngmpwequb.pif	WScript.exe
PID 964 wrote to memory of 1508	964	WScript.exe	kngmpwequb.pif
PID 964 wrote to memory of 1508	964	WScript.exe	kngmpwequb.pif
PID 964 wrote to memory of 1508	964	WScript.exe	kngmpwequb.pif
PID 964 wrote to memory of 1508	964	WScript.exe	kngmpwequb.pif
PID 1508 wrote to memory of 1924	1508	kngmpwequb.pif	RegSvcs.exe
PID 1508 wrote to memory of 1924	1508	kngmpwequb.pif	RegSvcs.exe
PID 1508 wrote to memory of 1924	1508	kngmpwequb.pif	RegSvcs.exe
PID 1508 wrote to memory of 1924	1508	kngmpwequb.pif	RegSvcs.exe
PID 1508 wrote to memory of 1924	1508	kngmpwequb.pif	RegSvcs.exe
PID 1508 wrote to memory of 1924	1508	kngmpwequb.pif	RegSvcs.exe
PID 1508 wrote to memory of 1924	1508	kngmpwequb.pif	RegSvcs.exe
PID 1508 wrote to memory of 1924	1508	kngmpwequb.pif	RegSvcs.exe
PID 1508 wrote to memory of 1924	1508	kngmpwequb.pif	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe
"C:\Users\Admin\AppData\Local\Temp\273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644

C:\33725277\kngmpwequb.pif
"C:\33725277\kngmpwequb.pif" xpomrfvel.rqn
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664

C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
PID:1780

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\33725277\run.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\33725277\kngmpwequb.pif
"C:\33725277\kngmpwequb.pif" xpomrfvel.rqn
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1508

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\33725277\arggi.xls
MD5
823007f5c65d9fe990fc54bf62115e57

SHA1
4f82f8ecbd22962e5cc3fc0db945f624152395e7

SHA256
3c7a08daedb21220704ed349c7653a3e49b832b1f5680511e34c13842ded7674

SHA512
1fbe5f6b3d7cc883b1a32d9ddabe30971b3c5e3da246fbef9f34c08da3121cb60a8298be22e60c083c1afc392f259f34d0c5718b22b5ccc168af5473344a53d7

Download Submit
C:\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
C:\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
C:\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
C:\33725277\run.vbs
MD5
bd16d4520614b3c9d71e2e0c83ca5d13

SHA1
6e402d7033b0a07c4bcbd1f5a99603b2e9a6e5a9

SHA256
a9cf9d1cb3b01df857a63916ca3f930c496be6508f8f5fc1f831c98e65c181f5

SHA512
431a0c9f162f4527ffefe3bc41eb872710229b03abf0f3e17840dc6c3e5e4336872af4aec23105b7b3686e5c451b022eb4144998a4f16f7be90409f4b1606b4e

Download Submit
C:\33725277\xpomrfvel.rqn
MD5
39b173c9805bd7eafa796540be0bc0c3

SHA1
c78582ee6526e8c962322a4d66b0f816ed2bdc36

SHA256
4b8662365d2085b4aa04273e740ffa1357e3cbac5590cc4b846a174b0e2d6e71

SHA512
5eae3743a7b80868d0f64abe51ad4c56ce39a2e10fb0333f23ff4248328270eda9d74463dec3c07cad9cb5a1ebff97090f355663966b1ac9217b6407c97415f7

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
\33725277\kngmpwequb.pif
MD5
43e7db53ce5c130179aef5b47dcf7608

SHA1
5398e207d9ad301860b570d87601c1664ada9c0a

SHA256
9c04aab5734e2e0eea44af2584333ecc093b27ef36a586fb8873b5d4cadcd7f1

SHA512
a79f8094152f4f0cb5f0763bc4cdfdc9061af322dfee1bac043de0ac7581f2a7b35841924fe224ecc73b6bda1fba6811045e513d45e8f3598ca6ec313b7103f4

Download Submit
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
\Users\Admin\AppData\Local\Temp\RegSvcs.exe
MD5
0e06054beb13192588e745ee63a84173

SHA1
30b7d4d1277bafd04a83779fd566a1f834a8d113

SHA256
c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768

SHA512
251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

Download Submit
memory/964-23-0x0000000000000000-mapping.dmp

Download
memory/964-28-0x0000000002700000-0x0000000002704000-memory.dmp

Filesize
16KB

Download
memory/1188-6-0x0000000000000000-mapping.dmp

Download
memory/1508-30-0x0000000003D50000-0x0000000003DF5000-memory.dmp

Filesize
660KB

Download
memory/1508-26-0x0000000000000000-mapping.dmp

Download
memory/1644-0-0x00000000024B0000-0x00000000025B1000-memory.dmp

Filesize
1.0MB

Download
memory/1664-14-0x00000000002D0000-0x0000000000921000-memory.dmp

Filesize
6.3MB

Download
memory/1664-12-0x000000000035F888-mapping.dmp

Download
memory/1664-11-0x00000000002D0000-0x0000000000921000-memory.dmp

Filesize
6.3MB

Download
memory/1780-20-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/1780-22-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1780-17-0x0000000000000000-mapping.dmp

Download
memory/1780-21-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/1924-33-0x00000000002D0000-0x00000000007C0000-memory.dmp

Filesize
4.9MB

Download
memory/1924-34-0x000000000035F888-mapping.dmp

Download
memory/1924-36-0x00000000002D0000-0x00000000007C0000-memory.dmp

Filesize
4.9MB

Download