Malware Analysis Report

2025-08-05 15:29

Sample ID 221019-rvtyvsccdr
Target d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e
SHA256 d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e
Tags
darkcomet guest16 evasion persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e

Threat Level: Known bad

The file d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e was found to be: Known bad.

Malicious Activity Summary

darkcomet guest16 evasion persistence rat trojan upx

Modifies WinLogon for persistence

Darkcomet

Executes dropped EXE

UPX packed file

Sets file to hidden

Loads dropped DLL

Deletes itself

Drops desktop.ini file(s)

Adds Run key to start application

AutoIT Executable

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-19 14:31

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-19 14:31

Reported

2022-10-19 15:46

Platform

win10v2004-20220812-en

Max time kernel

110s

Max time network

184s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Windows\SysWOW64\explorer.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe = "C:\\Users\\Admin\\AppData\\Roaming\\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe" C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Windows\SysWOW64\explorer.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\attrib.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4568 set thread context of 312 N/A C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64 C:\Windows\SysWOW64\attrib.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4452 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe
PID 4452 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe
PID 4452 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe
PID 4452 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\cmd.exe
PID 4452 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\cmd.exe
PID 4452 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\cmd.exe
PID 4568 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 4568 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 4568 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 4568 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 4568 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 312 wrote to memory of 2856 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 2856 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 2856 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 2420 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 2420 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 2420 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 312 wrote to memory of 4472 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2856 wrote to memory of 488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2420 wrote to memory of 4724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2856 wrote to memory of 488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2856 wrote to memory of 488 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2420 wrote to memory of 4724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2420 wrote to memory of 4724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 312 wrote to memory of 4860 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 312 wrote to memory of 4860 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 312 wrote to memory of 4860 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

"C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe"

C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Tempscratch.cmd

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\system32\explorer.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\explorer.exe" +s +h

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\explorer.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64" +s +h

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

Network

Country Destination Domain Proto
IE 13.69.239.74:443 tcp
US 8.247.211.254:80 tcp
US 8.247.211.254:80 tcp
US 209.197.3.8:80 tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 8.247.211.254:80 tcp
US 8.247.211.254:80 tcp
US 93.184.220.29:80 tcp

Files

memory/4452-132-0x0000000000400000-0x00000000004FE000-memory.dmp

memory/4452-133-0x0000000000400000-0x00000000004FE000-memory.dmp

memory/4568-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

MD5 a20d99cf1d92e6b93810eed118feb880
SHA1 f10a8c84559386e512815f5e7b0e803c2cbc9ea2
SHA256 d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e
SHA512 cd49a1f5374d2b63561568c0d820fd2ba6d2d54a249f808e6826a5a499a0bc046a081a66f485069d24006da56841b1bb451fc858a19f65b44f5e68d7b404c7d4

C:\Users\Admin\AppData\Roaming\86050d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

MD5 a20d99cf1d92e6b93810eed118feb880
SHA1 f10a8c84559386e512815f5e7b0e803c2cbc9ea2
SHA256 d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e
SHA512 cd49a1f5374d2b63561568c0d820fd2ba6d2d54a249f808e6826a5a499a0bc046a081a66f485069d24006da56841b1bb451fc858a19f65b44f5e68d7b404c7d4

memory/996-137-0x0000000000000000-mapping.dmp

memory/4568-138-0x0000000000400000-0x00000000004FE000-memory.dmp

C:\Users\Admin\AppData\Local\Tempscratch.cmd

MD5 144cad0760a5a3c194e8f81b1a199207
SHA1 9a56de0c82cf9f2817763d9b6616f1bb434775b5
SHA256 7622731f0d69b59fe7bb6d70e4f55ccd54562406d1c92b429ecf4e5d33adbd6e
SHA512 47854437f0dd08ae8a0fff3498b464dc959a5ba358c9983ef4aa51ab29e2d58f948f82afa526a4ed214ceed695fd9d3c4cd70fefe2e1fb7c7619d079d16e7a31

memory/4452-140-0x0000000000400000-0x00000000004FE000-memory.dmp

memory/312-141-0x0000000000000000-mapping.dmp

memory/312-142-0x00000000012D0000-0x00000000013A7000-memory.dmp

memory/312-143-0x00000000012D0000-0x00000000013A7000-memory.dmp

memory/312-144-0x00000000012D0000-0x00000000013A7000-memory.dmp

memory/4568-145-0x0000000000400000-0x00000000004FE000-memory.dmp

memory/4568-146-0x0000000000400000-0x00000000004FE000-memory.dmp

memory/312-147-0x00000000012D0000-0x00000000013A7000-memory.dmp

memory/312-148-0x00000000012D0000-0x00000000013A7000-memory.dmp

memory/2856-149-0x0000000000000000-mapping.dmp

memory/2420-150-0x0000000000000000-mapping.dmp

memory/4472-151-0x0000000000000000-mapping.dmp

memory/488-152-0x0000000000000000-mapping.dmp

memory/4724-153-0x0000000000000000-mapping.dmp

memory/4860-154-0x0000000000000000-mapping.dmp

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 0155e85852fde62a441cbaf485e023be
SHA1 59482d4b1c0f061426ef71bff8506230faa00701
SHA256 e0689419d3d7879a229ecf3e74639e4e9ba0669ed4574f47b108097593fc9fbc
SHA512 f1a43adb7b0203dc5ad4613da9645070c4da0d15d8788b50644cb80420d4a38151488aa3888da39a6cb17ef6d3f5ebc5fe08ac948dca1fd0c852dceecd3bafff

memory/312-156-0x00000000012D0000-0x00000000013A7000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 14:31

Reported

2022-10-19 15:46

Platform

win7-20220901-en

Max time kernel

163s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Windows\SysWOW64\explorer.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe = "C:\\Users\\Admin\\AppData\\Roaming\\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe" C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Windows\SysWOW64\explorer.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\attrib.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1060 set thread context of 1412 N/A C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64 C:\Windows\SysWOW64\attrib.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 888 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe
PID 888 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe
PID 888 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe
PID 888 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe
PID 888 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\cmd.exe
PID 888 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\cmd.exe
PID 888 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\cmd.exe
PID 888 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 1060 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 1060 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 1060 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 1060 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 1060 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe C:\Windows\SysWOW64\explorer.exe
PID 1412 wrote to memory of 1200 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 1200 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 1200 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 1200 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 1204 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 1204 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 1204 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 1204 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1200 wrote to memory of 556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1200 wrote to memory of 556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1200 wrote to memory of 556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1200 wrote to memory of 556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1204 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1204 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1204 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1204 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1544 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1412 wrote to memory of 1984 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 1412 wrote to memory of 1984 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 1412 wrote to memory of 1984 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 1412 wrote to memory of 1984 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

"C:\Users\Admin\AppData\Local\Temp\d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe"

C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Tempscratch.cmd

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\system32\explorer.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\explorer.exe" +s +h

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\explorer.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64" +s +h

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

Network

N/A

Files

memory/888-54-0x0000000076961000-0x0000000076963000-memory.dmp

memory/888-55-0x0000000000400000-0x00000000004FE000-memory.dmp

\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

MD5 a20d99cf1d92e6b93810eed118feb880
SHA1 f10a8c84559386e512815f5e7b0e803c2cbc9ea2
SHA256 d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e
SHA512 cd49a1f5374d2b63561568c0d820fd2ba6d2d54a249f808e6826a5a499a0bc046a081a66f485069d24006da56841b1bb451fc858a19f65b44f5e68d7b404c7d4

memory/1060-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

MD5 a20d99cf1d92e6b93810eed118feb880
SHA1 f10a8c84559386e512815f5e7b0e803c2cbc9ea2
SHA256 d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e
SHA512 cd49a1f5374d2b63561568c0d820fd2ba6d2d54a249f808e6826a5a499a0bc046a081a66f485069d24006da56841b1bb451fc858a19f65b44f5e68d7b404c7d4

memory/1408-60-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\67051d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e.exe

MD5 a20d99cf1d92e6b93810eed118feb880
SHA1 f10a8c84559386e512815f5e7b0e803c2cbc9ea2
SHA256 d083f1a5350e9fd23e9ac8e23d42feb463e515910f1e892a609d980ac4e3553e
SHA512 cd49a1f5374d2b63561568c0d820fd2ba6d2d54a249f808e6826a5a499a0bc046a081a66f485069d24006da56841b1bb451fc858a19f65b44f5e68d7b404c7d4

C:\Users\Admin\AppData\Local\Tempscratch.cmd

MD5 144cad0760a5a3c194e8f81b1a199207
SHA1 9a56de0c82cf9f2817763d9b6616f1bb434775b5
SHA256 7622731f0d69b59fe7bb6d70e4f55ccd54562406d1c92b429ecf4e5d33adbd6e
SHA512 47854437f0dd08ae8a0fff3498b464dc959a5ba358c9983ef4aa51ab29e2d58f948f82afa526a4ed214ceed695fd9d3c4cd70fefe2e1fb7c7619d079d16e7a31

memory/1060-63-0x0000000000400000-0x00000000004FE000-memory.dmp

memory/888-64-0x0000000000400000-0x00000000004FE000-memory.dmp

memory/1412-65-0x00000000001B0000-0x0000000000287000-memory.dmp

memory/1412-67-0x00000000001B0000-0x0000000000287000-memory.dmp

memory/1412-68-0x000000000023F888-mapping.dmp

memory/1060-69-0x0000000000400000-0x00000000004FE000-memory.dmp

memory/1412-70-0x00000000001B0000-0x0000000000287000-memory.dmp

memory/1412-72-0x00000000001B0000-0x0000000000287000-memory.dmp

memory/1412-73-0x00000000001B0000-0x0000000000287000-memory.dmp

memory/1200-74-0x0000000000000000-mapping.dmp

memory/1204-75-0x0000000000000000-mapping.dmp

memory/744-78-0x0000000000000000-mapping.dmp

memory/556-77-0x0000000000000000-mapping.dmp

memory/1544-76-0x0000000000000000-mapping.dmp

\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 40d777b7a95e00593eb1568c68514493
SHA1 89a175a12bc20104770d0ef83e553f8b0e06274b
SHA256 0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894
SHA512 d5719baef8bef791ef99b4c88d449d45f199638438bd929c1a3e7a74309931c72e03567633135a4fcf4c92e2b53e552f9526cba2e1d85383906d3c1aa21dd67f

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 40d777b7a95e00593eb1568c68514493
SHA1 89a175a12bc20104770d0ef83e553f8b0e06274b
SHA256 0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894
SHA512 d5719baef8bef791ef99b4c88d449d45f199638438bd929c1a3e7a74309931c72e03567633135a4fcf4c92e2b53e552f9526cba2e1d85383906d3c1aa21dd67f

memory/1984-81-0x0000000000000000-mapping.dmp

memory/1984-84-0x0000000074431000-0x0000000074433000-memory.dmp

memory/2016-85-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

memory/2016-86-0x0000000003940000-0x0000000003950000-memory.dmp

memory/1412-87-0x00000000001B0000-0x0000000000287000-memory.dmp