darkcomet | 418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f

Analysis

max time kernel
153s
max time network
182s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe
Size

573KB
MD5

c9c05cae0a7af3f0d2b4091682caa3e4
SHA1

73ab52ec297aad007322feb4279605ac91ebb4e6
SHA256

418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f
SHA512

ba77a67e8851a73f238fd1f940bc3a3696a54d0aa51217c021d771a29a4599e012720bc6bd27e57942e1fcd3196cebde39bb1e41337026f6f1e24cdb9b5b3965
SSDEEP

12288:qRWNcr8oxnJ9yxBdBaHnQuQUxM0lpS0WIzdfGWVX5eow:ZNBIJQteQYMapS0W6de6W

Score

10^/10

darkcomet guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

jonas24.no-ip.biz:1630

Mutex

DC_MUTEX-FYQ3L58

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
oVsFPxtqM18C
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	server.exe

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	iexplore.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	iexplore.exe

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

msdcsc.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iexplore.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 3 IoCs

Processes:

server.sfx.exeserver.exemsdcsc.exe

pid process

592 server.sfx.exe
2024 server.exe
1512 msdcsc.exe
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1780 attrib.exe
1132 attrib.exe
Loads dropped DLL 8 IoCs

Processes:

cmd.exeserver.sfx.exeserver.exe

pid process

1552 cmd.exe
592 server.sfx.exe
592 server.sfx.exe
592 server.sfx.exe
592 server.sfx.exe
592 server.sfx.exe
2024 server.exe
2024 server.exe

pid	process
592	server.sfx.exe
2024	server.exe
1512	msdcsc.exe

pid	process
1780	attrib.exe
1132	attrib.exe

pid	process
1552	cmd.exe
592	server.sfx.exe
592	server.sfx.exe
592	server.sfx.exe
592	server.sfx.exe
592	server.sfx.exe
2024	server.exe
2024	server.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

server.exemsdcsc.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

msdcsc.exe

description pid process target process

PID 1512 set thread context of 1264 1512 msdcsc.exe iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1264 iexplore.exe

description	pid	process	target process
PID 1512 set thread context of 1264	1512	msdcsc.exe	iexplore.exe

pid	process
1264	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

server.exemsdcsc.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2024	server.exe
Token: SeSecurityPrivilege	2024	server.exe
Token: SeTakeOwnershipPrivilege	2024	server.exe
Token: SeLoadDriverPrivilege	2024	server.exe
Token: SeSystemProfilePrivilege	2024	server.exe
Token: SeSystemtimePrivilege	2024	server.exe
Token: SeProfSingleProcessPrivilege	2024	server.exe
Token: SeIncBasePriorityPrivilege	2024	server.exe
Token: SeCreatePagefilePrivilege	2024	server.exe
Token: SeBackupPrivilege	2024	server.exe
Token: SeRestorePrivilege	2024	server.exe
Token: SeShutdownPrivilege	2024	server.exe
Token: SeDebugPrivilege	2024	server.exe
Token: SeSystemEnvironmentPrivilege	2024	server.exe
Token: SeChangeNotifyPrivilege	2024	server.exe
Token: SeRemoteShutdownPrivilege	2024	server.exe
Token: SeUndockPrivilege	2024	server.exe
Token: SeManageVolumePrivilege	2024	server.exe
Token: SeImpersonatePrivilege	2024	server.exe
Token: SeCreateGlobalPrivilege	2024	server.exe
Token: 33	2024	server.exe
Token: 34	2024	server.exe
Token: 35	2024	server.exe
Token: SeIncreaseQuotaPrivilege	1512	msdcsc.exe
Token: SeSecurityPrivilege	1512	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1512	msdcsc.exe
Token: SeLoadDriverPrivilege	1512	msdcsc.exe
Token: SeSystemProfilePrivilege	1512	msdcsc.exe
Token: SeSystemtimePrivilege	1512	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1512	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1512	msdcsc.exe
Token: SeCreatePagefilePrivilege	1512	msdcsc.exe
Token: SeBackupPrivilege	1512	msdcsc.exe
Token: SeRestorePrivilege	1512	msdcsc.exe
Token: SeShutdownPrivilege	1512	msdcsc.exe
Token: SeDebugPrivilege	1512	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1512	msdcsc.exe
Token: SeChangeNotifyPrivilege	1512	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1512	msdcsc.exe
Token: SeUndockPrivilege	1512	msdcsc.exe
Token: SeManageVolumePrivilege	1512	msdcsc.exe
Token: SeImpersonatePrivilege	1512	msdcsc.exe
Token: SeCreateGlobalPrivilege	1512	msdcsc.exe
Token: 33	1512	msdcsc.exe
Token: 34	1512	msdcsc.exe
Token: 35	1512	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	1264	iexplore.exe
Token: SeSecurityPrivilege	1264	iexplore.exe
Token: SeTakeOwnershipPrivilege	1264	iexplore.exe
Token: SeLoadDriverPrivilege	1264	iexplore.exe
Token: SeSystemProfilePrivilege	1264	iexplore.exe
Token: SeSystemtimePrivilege	1264	iexplore.exe
Token: SeProfSingleProcessPrivilege	1264	iexplore.exe
Token: SeIncBasePriorityPrivilege	1264	iexplore.exe
Token: SeCreatePagefilePrivilege	1264	iexplore.exe
Token: SeBackupPrivilege	1264	iexplore.exe
Token: SeRestorePrivilege	1264	iexplore.exe
Token: SeShutdownPrivilege	1264	iexplore.exe
Token: SeDebugPrivilege	1264	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1264	iexplore.exe
Token: SeChangeNotifyPrivilege	1264	iexplore.exe
Token: SeRemoteShutdownPrivilege	1264	iexplore.exe
Token: SeUndockPrivilege	1264	iexplore.exe
Token: SeManageVolumePrivilege	1264	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

1264 iexplore.exe

pid	process
1264	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.execmd.exeserver.sfx.exeserver.execmd.execmd.exe

description	pid	process	target process
PID 1220 wrote to memory of 1552	1220	418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe	cmd.exe
PID 1220 wrote to memory of 1552	1220	418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe	cmd.exe
PID 1220 wrote to memory of 1552	1220	418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe	cmd.exe
PID 1220 wrote to memory of 1552	1220	418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe	cmd.exe
PID 1220 wrote to memory of 1552	1220	418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe	cmd.exe
PID 1220 wrote to memory of 1552	1220	418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe	cmd.exe
PID 1220 wrote to memory of 1552	1220	418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe	cmd.exe
PID 1552 wrote to memory of 592	1552	cmd.exe	server.sfx.exe
PID 1552 wrote to memory of 592	1552	cmd.exe	server.sfx.exe
PID 1552 wrote to memory of 592	1552	cmd.exe	server.sfx.exe
PID 1552 wrote to memory of 592	1552	cmd.exe	server.sfx.exe
PID 1552 wrote to memory of 592	1552	cmd.exe	server.sfx.exe
PID 1552 wrote to memory of 592	1552	cmd.exe	server.sfx.exe
PID 1552 wrote to memory of 592	1552	cmd.exe	server.sfx.exe
PID 592 wrote to memory of 2024	592	server.sfx.exe	server.exe
PID 592 wrote to memory of 2024	592	server.sfx.exe	server.exe
PID 592 wrote to memory of 2024	592	server.sfx.exe	server.exe
PID 592 wrote to memory of 2024	592	server.sfx.exe	server.exe
PID 592 wrote to memory of 2024	592	server.sfx.exe	server.exe
PID 592 wrote to memory of 2024	592	server.sfx.exe	server.exe
PID 592 wrote to memory of 2024	592	server.sfx.exe	server.exe
PID 2024 wrote to memory of 1212	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1212	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1212	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1212	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1212	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1212	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1212	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1492	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1492	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1492	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1492	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1492	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1492	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1492	2024	server.exe	cmd.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 2024 wrote to memory of 1920	2024	server.exe	notepad.exe
PID 1212 wrote to memory of 1780	1212	cmd.exe	attrib.exe
PID 1212 wrote to memory of 1780	1212	cmd.exe	attrib.exe
PID 1212 wrote to memory of 1780	1212	cmd.exe	attrib.exe
PID 1212 wrote to memory of 1780	1212	cmd.exe	attrib.exe
PID 1212 wrote to memory of 1780	1212	cmd.exe	attrib.exe
PID 1212 wrote to memory of 1780	1212	cmd.exe	attrib.exe
PID 1212 wrote to memory of 1780	1212	cmd.exe	attrib.exe
PID 1492 wrote to memory of 1132	1492	cmd.exe	attrib.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1780 attrib.exe
1132 attrib.exe

pid	process
1780	attrib.exe
1132	attrib.exe

C:\Users\Admin\AppData\Local\Temp\418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe
"C:\Users\Admin\AppData\Local\Temp\418c793d114ddcb9dac4b04b08b32c74858b47f9df654c43e10b687ab8442e1f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\fud.bat" "
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552

C:\Users\Admin\AppData\Local\Temp\RarSFX0\server.sfx.exe
Server.sfx.exe -p123 -dC:\Users\Admin\AppData\Local\Temp
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592

C:\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe"
4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe" +s +h
5⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe" +s +h
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1780

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\RarSFX1" +s +h
5⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\RarSFX1" +s +h
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1132

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:1920

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
5⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1512

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
6⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1264

C:\Windows\SysWOW64\notepad.exe
notepad
7⤵
PID:1932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\fud.bat
Filesize
29B

MD5
2f7a8311a80bac88bdb24f6444cf867b

SHA1
b88808595430620ccb47e1513f9f80a7300672c7

SHA256
42a20ef5dd7d810ca2a2e64c84ce7ebdd1710ea338fed7c22d7b8b4c2ad0edd7

SHA512
c5805844df8d8f1a3bd10f25db72484cda47f7e6f77d7c823c6777497983ebd42a498f3efffddf0e9feeb0bb8c0e5d09c2a5bb1779c65841d8ea4f3ba47ae012

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\server.sfx.exe
Filesize
476KB

MD5
8f6946a39d2fa75a1dfa050c61c2d10e

SHA1
1d710a544c0570e21e9668f9bcf286aa8651368d

SHA256
f2ac53cb6c9d4035953fd0facd4dc36baa8b1a7bd619d7787a6348c4ef76de21

SHA512
b6ab71d25dbb65d9d711fda0816876591c2df33276cd0ffa9f1627acb8fab1e030906d84498839fd954dc80813f6c24fe16edb23026c3d30f0e0a7a17468fc54

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\server.sfx.exe
Filesize
476KB

MD5
8f6946a39d2fa75a1dfa050c61c2d10e

SHA1
1d710a544c0570e21e9668f9bcf286aa8651368d

SHA256
f2ac53cb6c9d4035953fd0facd4dc36baa8b1a7bd619d7787a6348c4ef76de21

SHA512
b6ab71d25dbb65d9d711fda0816876591c2df33276cd0ffa9f1627acb8fab1e030906d84498839fd954dc80813f6c24fe16edb23026c3d30f0e0a7a17468fc54

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\server.sfx.exe
Filesize
476KB

MD5
8f6946a39d2fa75a1dfa050c61c2d10e

SHA1
1d710a544c0570e21e9668f9bcf286aa8651368d

SHA256
f2ac53cb6c9d4035953fd0facd4dc36baa8b1a7bd619d7787a6348c4ef76de21

SHA512
b6ab71d25dbb65d9d711fda0816876591c2df33276cd0ffa9f1627acb8fab1e030906d84498839fd954dc80813f6c24fe16edb23026c3d30f0e0a7a17468fc54

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\server.exe
Filesize
756KB

MD5
90a107c3d53c5cbecd748bce9005add6

SHA1
1a8ad010c53cd75af7d42cd22b90075d14e4842c

SHA256
78f119546654d1e4236221242d84ab342e558c382bc7174c6062c9ffae1c6447

SHA512
9f943fb6d0424694646398880e0706a69db68216cbef00351b6a1d3457f621cd5965d570068f53ecee107130f506eb395a7e021662a82f13bc746ff88a63bfbc

Download Submit
memory/592-60-0x0000000000000000-mapping.dmp

Download
memory/1132-80-0x0000000000000000-mapping.dmp

Download
memory/1212-72-0x0000000000000000-mapping.dmp

Download
memory/1220-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1492-73-0x0000000000000000-mapping.dmp

Download
memory/1512-84-0x0000000000000000-mapping.dmp

Download
memory/1552-55-0x0000000000000000-mapping.dmp

Download
memory/1780-76-0x0000000000000000-mapping.dmp

Download
memory/1920-75-0x0000000000000000-mapping.dmp

Download
memory/1932-88-0x0000000000000000-mapping.dmp

Download
memory/2024-68-0x0000000000000000-mapping.dmp

Download