Analysis Overview
SHA256
e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78
Threat Level: Known bad
The file e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 was found to be: Known bad.
Malicious Activity Summary
Modifies firewall policy service
Darkcomet
Modifies WinLogon for persistence
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Drops startup file
Adds Run key to start application
Program crash
Drops file in System32 directory
Suspicious use of SetThreadContext
Enumerates physical storage devices
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-10-11 06:30
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-10-11 06:30
Reported
2022-10-11 08:12
Platform
win7-20220812-en
Max time kernel
151s
Max time network
42s
Command Line
Signatures
Darkcomet
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
Executes dropped EXE
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
Loads dropped DLL
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
Suspicious use of SetThreadContext
Enumerates physical storage devices
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe
"C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe
C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
Files
memory/576-54-0x0000000075911000-0x0000000075913000-memory.dmp
memory/576-55-0x00000000002C0000-0x00000000002C4000-memory.dmp
memory/2012-56-0x0000000000000000-mapping.dmp
memory/1640-57-0x0000000000000000-mapping.dmp
memory/984-58-0x0000000000000000-mapping.dmp
\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1924-61-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1924-60-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1924-63-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1924-65-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1924-67-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1924-69-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1924-70-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1924-74-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1924-72-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1924-77-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1924-75-0x0000000000490888-mapping.dmp
memory/1924-79-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1756-83-0x0000000000000000-mapping.dmp
\Windows\SysWOW64\MSDCSC\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1924-81-0x0000000000400000-0x00000000004B5000-memory.dmp
\Windows\SysWOW64\MSDCSC\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1760-90-0x0000000000000000-mapping.dmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/384-91-0x0000000000000000-mapping.dmp
memory/1236-92-0x0000000000000000-mapping.dmp
memory/656-108-0x0000000000490888-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/656-112-0x0000000000400000-0x00000000004B5000-memory.dmp
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1212-115-0x0000000000000000-mapping.dmp
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/656-117-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1184-123-0x0000000000000000-mapping.dmp
memory/968-124-0x0000000000000000-mapping.dmp
memory/628-125-0x0000000000000000-mapping.dmp
memory/360-141-0x0000000000490888-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1864-148-0x0000000000000000-mapping.dmp
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/360-150-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2008-156-0x0000000000000000-mapping.dmp
memory/1448-157-0x0000000000000000-mapping.dmp
memory/1988-158-0x0000000000000000-mapping.dmp
memory/916-174-0x0000000000490888-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/384-181-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/916-182-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1400-189-0x0000000000000000-mapping.dmp
memory/1680-190-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/700-191-0x0000000000000000-mapping.dmp
memory/1780-207-0x0000000000490888-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/952-214-0x0000000000000000-mapping.dmp
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1780-216-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2004-222-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1480-223-0x0000000000000000-mapping.dmp
memory/1984-239-0x0000000000490888-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1200-246-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1984-247-0x0000000000400000-0x00000000004B5000-memory.dmp
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1784-254-0x0000000000000000-mapping.dmp
memory/1848-256-0x0000000000000000-mapping.dmp
memory/1712-255-0x0000000000000000-mapping.dmp
memory/1672-272-0x0000000000490888-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/976-279-0x0000000000000000-mapping.dmp
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1672-281-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1396-287-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1552-288-0x0000000000000000-mapping.dmp
memory/1424-289-0x0000000000000000-mapping.dmp
memory/1944-305-0x0000000000490888-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1944-313-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1640-312-0x0000000000000000-mapping.dmp
\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1204-319-0x0000000000000000-mapping.dmp
memory/2040-320-0x0000000000000000-mapping.dmp
memory/2032-321-0x0000000000000000-mapping.dmp
memory/584-337-0x0000000000490888-mapping.dmp
memory/1964-341-0x0000000000000000-mapping.dmp
memory/584-342-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2024-344-0x0000000000000000-mapping.dmp
memory/1584-345-0x0000000000000000-mapping.dmp
memory/1756-346-0x0000000000000000-mapping.dmp
memory/568-362-0x0000000000490888-mapping.dmp
memory/968-366-0x0000000000000000-mapping.dmp
memory/568-367-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1548-369-0x0000000000000000-mapping.dmp
memory/1776-370-0x0000000000000000-mapping.dmp
memory/2020-371-0x0000000000000000-mapping.dmp
memory/1396-387-0x0000000000490888-mapping.dmp
memory/1592-391-0x0000000000000000-mapping.dmp
memory/1396-392-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1764-394-0x0000000000000000-mapping.dmp
memory/1092-395-0x0000000000000000-mapping.dmp
memory/1324-396-0x0000000000000000-mapping.dmp
memory/456-412-0x0000000000490888-mapping.dmp
memory/984-416-0x0000000000000000-mapping.dmp
memory/456-417-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/112-419-0x0000000000000000-mapping.dmp
memory/1380-420-0x0000000000000000-mapping.dmp
memory/1164-421-0x0000000000000000-mapping.dmp
memory/1824-437-0x0000000000490888-mapping.dmp
memory/1212-441-0x0000000000000000-mapping.dmp
memory/1824-442-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2012-462-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1848-482-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1276-502-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/628-522-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/956-542-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1132-562-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2004-582-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2008-602-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/700-622-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1632-642-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1676-662-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1416-682-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1968-702-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1728-722-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/764-742-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/904-762-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/800-782-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1104-802-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1748-822-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2040-842-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/560-862-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1988-882-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/112-902-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1380-922-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1584-942-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1752-962-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1592-982-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1668-1002-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1108-1022-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1468-1042-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1872-1062-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/796-1082-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1184-1102-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1536-1122-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/680-1142-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/772-1162-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/992-1182-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/620-1202-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1376-1222-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1640-1242-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1524-1262-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1416-1282-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1684-1302-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1600-1322-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1788-1342-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1624-1362-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/976-1382-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1620-1402-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1164-1422-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2028-1442-0x0000000000400000-0x00000000004B5000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-10-11 06:30
Reported
2022-10-11 08:13
Platform
win10v2004-20220812-en
Max time kernel
175s
Max time network
184s
Command Line
Signatures
Darkcomet
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
Executes dropped EXE
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\1rfCET8uJzu8\\1rfCET8uJzu8\\msdcsc.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\InstallDir\\help.exe" | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
Program crash
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir | C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File created | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\ | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\InstallDir\help.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe | N/A |
Suspicious use of SetThreadContext
Enumerates physical storage devices
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe
"C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4364 -ip 4364
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe
C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 84
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1108 -ip 1108
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 84
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1388 -ip 1388
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 84
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1212 -ip 1212
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 84
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3224 -ip 3224
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 84
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4188 -ip 4188
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 12
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3160 -ip 3160
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 156
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4076 -ip 4076
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 84
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4928 -ip 4928
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 8
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4188 -ip 4188
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 56
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3432 -ip 3432
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 84
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4456 -ip 4456
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 84
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\msdcsc.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1864 -ip 1864
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 80
C:\Windows\SysWOW64\net.exe
net stop MpsSvc
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MpsSvc
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
"C:\Windows\system32\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe"
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\SysWOW64\cmd.exe
/c net stop MpsSvc
Network
| Country | Destination | Domain | Proto |
| US | 93.184.220.29:80 | tcp | |
| NL | 95.101.78.106:80 | tcp | |
| NL | 95.101.78.106:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 204.79.197.200:443 | tcp | |
| DE | 51.116.253.168:443 | tcp | |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 93.184.220.29:80 | tcp | |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
| US | 8.8.8.8:53 | khoirizma.no-ip.biz | udp |
Files
memory/1364-132-0x0000000000000000-mapping.dmp
memory/1352-133-0x0000000000000000-mapping.dmp
memory/4964-134-0x0000000000B30000-0x0000000000B34000-memory.dmp
memory/4360-135-0x0000000000000000-mapping.dmp
memory/4644-136-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4644-139-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4644-137-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4644-140-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4644-141-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4264-142-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4520-148-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/3704-149-0x0000000000000000-mapping.dmp
memory/4284-150-0x0000000000000000-mapping.dmp
memory/4508-151-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4508-155-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2800-156-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4508-159-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1224-163-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4604-164-0x0000000000000000-mapping.dmp
memory/4736-165-0x0000000000000000-mapping.dmp
memory/2076-166-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2076-171-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/3696-172-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1964-178-0x0000000000000000-mapping.dmp
memory/3500-179-0x0000000000000000-mapping.dmp
memory/4448-180-0x0000000000000000-mapping.dmp
memory/1200-181-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1200-186-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1584-187-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2284-193-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1496-194-0x0000000000000000-mapping.dmp
memory/1060-195-0x0000000000000000-mapping.dmp
memory/2424-196-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2424-201-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/536-202-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2424-204-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4988-209-0x0000000000000000-mapping.dmp
memory/1404-210-0x0000000000000000-mapping.dmp
memory/3460-211-0x0000000000000000-mapping.dmp
memory/4680-212-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4680-217-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4216-218-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2336-224-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2884-225-0x0000000000000000-mapping.dmp
memory/2316-226-0x0000000000000000-mapping.dmp
memory/4044-227-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4044-232-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2992-233-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4360-239-0x0000000000000000-mapping.dmp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/5092-240-0x0000000000000000-mapping.dmp
memory/3904-241-0x0000000000000000-mapping.dmp
memory/888-242-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/888-247-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/888-250-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/3704-248-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/5032-255-0x0000000000000000-mapping.dmp
memory/4144-256-0x0000000000000000-mapping.dmp
memory/1868-257-0x0000000000000000-mapping.dmp
memory/4552-258-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/3364-263-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4552-265-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4604-270-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1284-271-0x0000000000000000-mapping.dmp
memory/1112-272-0x0000000000000000-mapping.dmp
memory/4196-273-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2312-278-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/4196-280-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\Windows\SysWOW64\InstallDir\help.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/5012-285-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2968-286-0x0000000000000000-mapping.dmp
memory/1512-287-0x0000000000000000-mapping.dmp
memory/1568-288-0x0000000000000000-mapping.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/1568-293-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/3576-294-0x0000000000000000-mapping.dmp
memory/1568-296-0x0000000000400000-0x00000000004B5000-memory.dmp
C:\Windows\SysWOW64\MSDCSC\1rfCET8uJzu8\1rfCET8uJzu8\msdcsc.exe
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\system.pif
| MD5 | 4fd55ff572a7aa68652436ca1c6260e6 |
| SHA1 | c3adb0cc3d5b0c3507c812923ce83e663229c6eb |
| SHA256 | e2381468df9338bce281b94e1968b56a1cd7c2e6024cff3586740a17938d2b78 |
| SHA512 | f4379a944ff1e54cd9b6d6453ca9b6d85ebbac89d484a64724c39ff109ef67e62d95d68bec13476744a8571e82298e9e21f12fe96050a23671316d78a0e875ae |
memory/2932-299-0x0000000000000000-mapping.dmp
memory/2028-300-0x0000000000000000-mapping.dmp
memory/1404-301-0x0000000000000000-mapping.dmp
memory/1416-302-0x0000000000000000-mapping.dmp
memory/2832-306-0x0000000000000000-mapping.dmp
memory/1416-307-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/3940-308-0x0000000000000000-mapping.dmp
memory/4952-309-0x0000000000000000-mapping.dmp
memory/1420-310-0x0000000000000000-mapping.dmp
memory/3076-311-0x0000000000000000-mapping.dmp
memory/3076-315-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1028-319-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2484-323-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/5064-327-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4684-331-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1496-335-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1496-336-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/3644-340-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1392-344-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/3296-348-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2804-352-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/3396-356-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4968-360-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1964-364-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2012-368-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2708-372-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/920-376-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/920-377-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4880-381-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2484-385-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1260-389-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1284-393-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/3976-397-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1500-401-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1736-405-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/3940-409-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/4852-413-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/2480-417-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/3196-421-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1000-425-0x0000000000400000-0x00000000004B5000-memory.dmp
memory/1000-426-0x0000000000400000-0x00000000004B5000-memory.dmp