darkcomet | 15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

Analysis

max time kernel
152s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Size

7.9MB
MD5

72b496240791ca602c67fcdb402ac9f4
SHA1

0f99c1c3131204e9b071a1bd4b8ea9800d1f9220
SHA256

15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813
SHA512

c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee
SSDEEP

98304:jiztTWzS1SotpmIvL2LdizqHlYtuiTDg8GRTr/Qt8dcO5f+58rcsvR/kOrMW2U/u:1wrLxzoYtBg8G2t4cn8LRIUf2EsBf

Score

10^/10

darkcomet justin persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

justin

dagile.no-ip.info:83

Mutex

DC_MUTEX-78SUFXL

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
p1yl91k0GTCs
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\p1yl91k0GTCs\\msdcsc.exe"	LilWayneftNickiMinaj-Rah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\p1yl91k0GTCs\\msdcsc.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\p1yl91k0GTCs\\p1yl91k0GTCs\\msdcsc.exe"	msdcsc.exe

Executes dropped EXE 4 IoCs

pid	Process
100	LilWayneftNickiMinaj-Rah.exe
1068	msdcsc.exe
900	msdcsc.exe
1760	msdcsc.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	LilWayneftNickiMinaj-Rah.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\p1yl91k0GTCs\\msdcsc.exe"	LilWayneftNickiMinaj-Rah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\p1yl91k0GTCs\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\p1yl91k0GTCs\\p1yl91k0GTCs\\msdcsc.exe"	msdcsc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 1068 set thread context of 1760	1068	msdcsc.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	LilWayneftNickiMinaj-Rah.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	msdcsc.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	LilWayneftNickiMinaj-Rah.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeSecurityPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeTakeOwnershipPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeLoadDriverPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeSystemProfilePrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeSystemtimePrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeProfSingleProcessPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeIncBasePriorityPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeCreatePagefilePrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeBackupPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeRestorePrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeShutdownPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeDebugPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeSystemEnvironmentPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeChangeNotifyPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeRemoteShutdownPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeUndockPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeManageVolumePrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeImpersonatePrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeCreateGlobalPrivilege	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: 33	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: 34	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: 35	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: 36	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
Token: SeIncreaseQuotaPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeSecurityPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeTakeOwnershipPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeLoadDriverPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeSystemProfilePrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeSystemtimePrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeProfSingleProcessPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeIncBasePriorityPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeCreatePagefilePrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeBackupPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeRestorePrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeShutdownPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeDebugPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeSystemEnvironmentPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeChangeNotifyPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeRemoteShutdownPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeUndockPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeManageVolumePrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeImpersonatePrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: SeCreateGlobalPrivilege	100	LilWayneftNickiMinaj-Rah.exe
Token: 33	100	LilWayneftNickiMinaj-Rah.exe
Token: 34	100	LilWayneftNickiMinaj-Rah.exe
Token: 35	100	LilWayneftNickiMinaj-Rah.exe
Token: 36	100	LilWayneftNickiMinaj-Rah.exe
Token: SeIncreaseQuotaPrivilege	900	msdcsc.exe
Token: SeSecurityPrivilege	900	msdcsc.exe
Token: SeTakeOwnershipPrivilege	900	msdcsc.exe
Token: SeLoadDriverPrivilege	900	msdcsc.exe
Token: SeSystemProfilePrivilege	900	msdcsc.exe
Token: SeSystemtimePrivilege	900	msdcsc.exe
Token: SeProfSingleProcessPrivilege	900	msdcsc.exe
Token: SeIncBasePriorityPrivilege	900	msdcsc.exe
Token: SeCreatePagefilePrivilege	900	msdcsc.exe
Token: SeBackupPrivilege	900	msdcsc.exe
Token: SeRestorePrivilege	900	msdcsc.exe
Token: SeShutdownPrivilege	900	msdcsc.exe
Token: SeDebugPrivilege	900	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	900	msdcsc.exe
Token: SeChangeNotifyPrivilege	900	msdcsc.exe
Token: SeRemoteShutdownPrivilege	900	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
900	msdcsc.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 1196	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	81
PID 5104 wrote to memory of 100	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	83
PID 5104 wrote to memory of 100	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	83
PID 5104 wrote to memory of 100	5104	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	83
PID 1196 wrote to memory of 260	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	82
PID 1196 wrote to memory of 260	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	82
PID 100 wrote to memory of 3592	100	LilWayneftNickiMinaj-Rah.exe	84
PID 100 wrote to memory of 3592	100	LilWayneftNickiMinaj-Rah.exe	84
PID 1196 wrote to memory of 1068	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	85
PID 1196 wrote to memory of 1068	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	85
PID 1196 wrote to memory of 1068	1196	15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe	85
PID 100 wrote to memory of 900	100	LilWayneftNickiMinaj-Rah.exe	86
PID 100 wrote to memory of 900	100	LilWayneftNickiMinaj-Rah.exe	86
PID 100 wrote to memory of 900	100	LilWayneftNickiMinaj-Rah.exe	86
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1068 wrote to memory of 1760	1068	msdcsc.exe	89
PID 1760 wrote to memory of 444	1760	msdcsc.exe	199
PID 1760 wrote to memory of 444	1760	msdcsc.exe	199

C:\Users\Admin\AppData\Local\Temp\15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
"C:\Users\Admin\AppData\Local\Temp\15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
  C:\Users\Admin\AppData\Local\Temp\15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
    3⤵
    PID:260
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Checks computer location settings
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        5⤵
        
        PID:444
    - - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        5⤵
        
        PID:2528
      - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        6⤵
        
        PID:1996
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        7⤵
        
        PID:1788
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        7⤵
        
        PID:1576
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        8⤵
        
        PID:4356
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        9⤵
        
        PID:2224
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        9⤵
        
        PID:1508
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        10⤵
        
        PID:3248
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        11⤵
        
        PID:2404
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        11⤵
        
        PID:3776
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        12⤵
        
        PID:3704
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        13⤵
        
        PID:4716
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        13⤵
        
        PID:2224
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        14⤵
        
        PID:3828
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        15⤵
        
        PID:1400
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        15⤵
        
        PID:1844
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        16⤵
        
        PID:2436
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        17⤵
        
        PID:4360
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        17⤵
        
        PID:4848
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        18⤵
        
        PID:3440
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:4448
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:4116
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:2740
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:4728
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:4728
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        22⤵
        
        PID:3820
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        23⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        18⤵
        
        PID:4608
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:4560
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:2360
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:1604
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5904
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        16⤵
        
        PID:4520
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        17⤵
        
        PID:4840
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        17⤵
        
        PID:1452
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        18⤵
        
        PID:3520
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:1524
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:1860
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:1596
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:64
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        20⤵
        
        PID:1924
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        14⤵
        
        PID:4348
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        15⤵
        
        PID:1524
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        15⤵
        
        PID:4504
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        16⤵
        
        PID:3812
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        17⤵
        
        PID:3232
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        17⤵
        
        PID:956
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        18⤵
        
        PID:4384
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:1676
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:4860
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:4396
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:4608
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        20⤵
        
        PID:5352
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        10⤵
        
        PID:5116
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        11⤵
        
        PID:744
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        11⤵
        
        PID:1792
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        12⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        8⤵
        
        PID:1780
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        9⤵
        
        PID:4492
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        9⤵
        
        PID:4176
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        10⤵
        
        PID:2372
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        11⤵
        
        PID:4036
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        11⤵
        
        PID:4100
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        12⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        6⤵
        
        PID:3096
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        7⤵
        
        PID:2296
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        7⤵
        
        PID:2820
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        8⤵
        
        PID:4856
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        9⤵
        
        PID:3316
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        9⤵
        
        PID:4448
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        10⤵
        
        PID:2152
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        11⤵
        
        PID:1868
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        11⤵
        
        PID:4472
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        12⤵
        
        PID:1460
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        13⤵
        
        PID:320
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        13⤵
        
        PID:1452
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        14⤵
        
        PID:2416
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        15⤵
        
        PID:1676
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        15⤵
        
        PID:1756
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        16⤵
        
        PID:3796
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        17⤵
        
        PID:1988
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        17⤵
        
        PID:1132
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        18⤵
        
        PID:4752
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:1748
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:4412
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:2932
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5720
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        20⤵
        
        PID:5812
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:6068
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
      "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
      4⤵
      PID:3396
    - - C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        5⤵
        
        PID:2772
    - - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        5⤵
        
        PID:3644
      - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        6⤵
        
        PID:4208
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        7⤵
        
        PID:2972
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        7⤵
        
        PID:2044
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        8⤵
        
        PID:2688
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        9⤵
        
        PID:1624
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        9⤵
        
        PID:2032
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        10⤵
        
        PID:4132
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        11⤵
        
        PID:1316
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        11⤵
        
        PID:1440
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        12⤵
        
        PID:2404
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        13⤵
        
        PID:448
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        13⤵
        
        PID:4492
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        14⤵
        
        PID:2928
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        15⤵
        
        PID:4848
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        15⤵
        
        PID:4264
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        16⤵
        
        PID:2760
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        17⤵
        
        PID:4592
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        17⤵
        
        PID:1296
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        18⤵
        
        PID:2576
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:2544
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:1288
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:4640
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:3692
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:5376
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        22⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        18⤵
        
        PID:3888
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:1268
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:884
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:4928
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5720
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        16⤵
        
        PID:444
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        17⤵
        
        PID:2448
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        17⤵
        
        PID:2584
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        18⤵
        
        PID:3516
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:4188
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:2968
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:2876
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5312
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:5284
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        22⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        20⤵
        
        PID:5728
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        14⤵
        
        PID:2820
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        15⤵
        
        PID:1456
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        15⤵
        
        PID:4012
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        16⤵
        
        PID:3636
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        17⤵
        
        PID:2444
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        17⤵
        
        PID:308
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        18⤵
        
        PID:2972
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:3920
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:5044
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:4840
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:1972
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        20⤵
        
        PID:6116
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        12⤵
        
        PID:2968
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        13⤵
        
        PID:2448
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        13⤵
        
        PID:3840
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        14⤵
        
        PID:5024
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        15⤵
        
        PID:4700
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        15⤵
        
        PID:460
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        16⤵
        
        PID:4224
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        17⤵
        
        PID:1344
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        17⤵
        
        PID:4560
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        18⤵
        
        PID:204
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:212
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:4016
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:876
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5244
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:6000
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        22⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        18⤵
        
        PID:5104
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:876
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:3032
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:3808
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:920
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        10⤵
        
        PID:4504
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        11⤵
        
        PID:2980
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        12⤵
        
        PID:2036
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        13⤵
        
        PID:2484
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        13⤵
        
        PID:4340
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        14⤵
        
        PID:3852
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        15⤵
        
        PID:3216
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        15⤵
        
        PID:2572
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        16⤵
        
        PID:3216
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        17⤵
        
        PID:4580
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        17⤵
        
        PID:1676
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        18⤵
        
        PID:1108
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:1820
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:1748
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:2308
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5824
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        20⤵
        
        PID:5936
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        18⤵
        
        PID:3808
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        19⤵
        
        PID:5092
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        19⤵
        
        PID:3560
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        20⤵
        
        PID:5196
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        21⤵
        
        PID:5724
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        21⤵
        
        PID:5472
- C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
  "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
    3⤵
    PID:3592
- - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x410
1⤵
PID:3928

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
1⤵
PID:2396

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
1⤵
PID:4360

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
1⤵
PID:3644

C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
1⤵
PID:3804
- C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
  C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
  2⤵
  PID:3256
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
    3⤵
    PID:4388
- - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
    3⤵
    PID:2204
  - - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
      4⤵
      PID:1624
    - - C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        5⤵
        
        PID:4796
    - - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        5⤵
        
        PID:4364
      - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        6⤵
        
        PID:1532
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        7⤵
        
        PID:5044
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        7⤵
        
        PID:1720
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        8⤵
        
        PID:4508
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        9⤵
        
        PID:5896

C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
1⤵
PID:2308
- C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
  C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
  2⤵
  PID:3604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
    3⤵
    PID:1264
- - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
    3⤵
    PID:3572
  - - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
      4⤵
      PID:4604
    - - C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        5⤵
        
        PID:3672
    - - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        5⤵
        
        PID:1348
      - C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        6⤵
        
        PID:4968
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        7⤵
        
        PID:4232
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        7⤵
        
        PID:3992
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        8⤵
        
        PID:2224
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        9⤵
        
        PID:5256
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        9⤵
        
        PID:5992
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        10⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        8⤵
        
        PID:5420
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        9⤵
        
        PID:4520
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        9⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe"
        6⤵
        
        PID:4848
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        7⤵
        
        PID:5108
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        "C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe"
        7⤵
        
        PID:5004
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        
        C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe
        8⤵
        
        PID:5516
        
        C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3"
        9⤵
        
        PID:5808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\msdcsc.exe.log

Filesize
594B

MD5
ecbfd3bb6bafa55951d244a50d79882a

SHA1
8675ee3f716484f771978390a780a798284a2786

SHA256
5e7cbc744b95460b7582bf8a44eb83846cc68a8b1eb5aabf8e21163e6a3ba476

SHA512
f00ff0454b815075ed791e7e693e2b3d00d0b86f3c86fab005145f1265563afdf8ce237626e02b0e25957cb8e17a14fb7039d60f1b4de6fd1b9f9d86242c4e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3

Filesize
3.1MB

MD5
1e848a8f8bddbc32c71f7f33b7e375d2

SHA1
e0a5f4c2ac69b99da5374df2f93fcbd553a7f5fc

SHA256
2ab3b212490869b83d26fa3790e0abaeae9c9048fd30bd92daa6fc29c521f230

SHA512
081316cf0fd59c798c6fbb28869bd58bf49ff18f0ee39e5c2e3a8f61d3b01714ce9fab6d904457d7bf94eec62f7b1cc2ad8649a3ba1aba0a274aa20e9a92eff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\LIL WAYNE FT NICKI MINAJ RICK ROSS THE GAME - RAH.MP3

Filesize
3.1MB

MD5
1e848a8f8bddbc32c71f7f33b7e375d2

SHA1
e0a5f4c2ac69b99da5374df2f93fcbd553a7f5fc

SHA256
2ab3b212490869b83d26fa3790e0abaeae9c9048fd30bd92daa6fc29c521f230

SHA512
081316cf0fd59c798c6fbb28869bd58bf49ff18f0ee39e5c2e3a8f61d3b01714ce9fab6d904457d7bf94eec62f7b1cc2ad8649a3ba1aba0a274aa20e9a92eff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LilWayneftNickiMinaj-Rah.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\msdcsc.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\msdcsc.exe

Filesize
3.8MB

MD5
1b81918c0dea555b04fe4fb607269ad7

SHA1
5cdd9dda8b513c3e0e03ff1d9f61a94ca7f54d9a

SHA256
fbbcb1720171277ac32093c71b07e5483c8d25c4bad07c42b8eb67c56339dfc1

SHA512
ce64bd3855e94c7bc68c507830fba47fa4644ea8073a62ad2e85b85793d5b1b30ed96f1e4287d72796d6aa856019aac82b3dfcf97892368c754c64c8512d739e

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
C:\Users\Admin\Documents\MSDCSC\p1yl91k0GTCs\p1yl91k0GTCs\msdcsc.exe

Filesize
7.9MB

MD5
72b496240791ca602c67fcdb402ac9f4

SHA1
0f99c1c3131204e9b071a1bd4b8ea9800d1f9220

SHA256
15662aee9a689cf70212560d853bffa3cee8a618adc80f3f285617ba3495f813

SHA512
c0a0e9e4dec163a7305dc1ee6768d60cc9637be3754ba2927cdac1172af7620f53221eea85d51b143b7c9739148f40bf1603ec0dec763bda4e0bcb4643e447ee

Download Submit
memory/680-350-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1068-210-0x0000000073B70000-0x0000000074121000-memory.dmp

Filesize
5.7MB

Download
memory/1068-154-0x0000000073B70000-0x0000000074121000-memory.dmp

Filesize
5.7MB

Download
memory/1196-136-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1196-135-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1196-134-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1196-137-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1196-153-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1440-290-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/1440-347-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/1460-352-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1508-280-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/1508-239-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/1576-227-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/1576-197-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/1760-160-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1760-170-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1792-310-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/1996-180-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1996-196-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2032-240-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2032-282-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2036-355-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2044-281-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2044-203-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2044-346-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2152-306-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2152-283-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2224-364-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2372-272-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2372-305-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2404-359-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2404-322-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2528-171-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2528-191-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2688-222-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2688-237-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/2820-204-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2820-248-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/2980-315-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/3240-351-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/3248-295-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/3248-260-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/3644-174-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/3644-230-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/3704-363-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/3704-330-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/3776-296-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/4100-316-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/4132-289-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/4132-259-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/4176-302-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/4176-247-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/4208-202-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/4208-188-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/4356-213-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/4356-238-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/4448-294-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/4448-246-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/4472-314-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/4472-362-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/4492-361-0x0000000073290000-0x0000000073841000-memory.dmp

Filesize
5.7MB

Download
memory/4856-245-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/4856-224-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/5104-145-0x0000000074AD0000-0x0000000075081000-memory.dmp

Filesize
5.7MB

Download
memory/5104-132-0x0000000074AD0000-0x0000000075081000-memory.dmp

Filesize
5.7MB

Download
memory/5104-138-0x0000000074AD0000-0x0000000075081000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads