Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 20:38
Static task
static1
Behavioral task
behavioral1
Sample
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Resource
win7-20220901-en
General
-
Target
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
-
Size
728KB
-
MD5
c08b5c86a6862dce171417d4784a8e9d
-
SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea
-
SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
-
SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
SSDEEP
12288:Ykn1cJbceCA9W+DoGSSPI1YEoaPwJjoAOJq+QeiiGWM6wGAizk/Jq+QeiiGWM6wd:YGqI9A9WLjSPPEoMwJjoAD+QeiiGN8pq
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 22 IoCs
Processes:
msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Executes dropped EXE 64 IoCs
Processes:
msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exepid process 1656 msdcsc.exe 1320 msdcsc.exe 1232 msdcsc.exe 1928 msdcsc.exe 1528 msdcsc.exe 1016 msdcsc.exe 2032 msdcsc.exe 612 msdcsc.exe 1428 msdcsc.exe 556 msdcsc.exe 1932 msdcsc.exe 1716 msdcsc.exe 1176 msdcsc.exe 2000 msdcsc.exe 1148 msdcsc.exe 1168 msdcsc.exe 1104 msdcsc.exe 1644 msdcsc.exe 1980 msdcsc.exe 1160 msdcsc.exe 2004 msdcsc.exe 1656 msdcsc.exe 1976 msdcsc.exe 1240 msdcsc.exe 1952 msdcsc.exe 1568 msdcsc.exe 1100 msdcsc.exe 1356 msdcsc.exe 1948 msdcsc.exe 1940 msdcsc.exe 1696 msdcsc.exe 1040 msdcsc.exe 1444 msdcsc.exe 828 msdcsc.exe 2008 msdcsc.exe 2032 msdcsc.exe 1168 msdcsc.exe 1728 msdcsc.exe 1632 msdcsc.exe 2016 msdcsc.exe 1176 msdcsc.exe 1964 msdcsc.exe 1452 msdcsc.exe 1436 msdcsc.exe 1656 msdcsc.exe 320 msdcsc.exe 756 msdcsc.exe 1368 msdcsc.exe 1928 msdcsc.exe 1684 msdcsc.exe 956 msdcsc.exe 1140 msdcsc.exe 1928 msdcsc.exe 520 msdcsc.exe 1284 msdcsc.exe 1536 msdcsc.exe 1056 msdcsc.exe 824 msdcsc.exe 1140 msdcsc.exe 1504 msdcsc.exe 1916 msdcsc.exe 1504 msdcsc.exe 1452 msdcsc.exe 1304 msdcsc.exe -
Processes:
resource yara_rule behavioral1/memory/668-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/668-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/668-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/668-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/668-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/668-79-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/668-86-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1232-113-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1232-114-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1232-121-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1016-149-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1016-150-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1016-157-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1428-192-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1716-218-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1716-226-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1148-255-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1148-260-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1644-298-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2004-332-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1240-365-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1100-402-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1940-436-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1444-472-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2032-507-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1632-532-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1964-555-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1656-579-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1368-604-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/956-629-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/520-653-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1056-678-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1504-702-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1504-703-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1452-730-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1864 cmd.exe -
Loads dropped DLL 44 IoCs
Processes:
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exepid process 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe 1232 msdcsc.exe 1232 msdcsc.exe 1016 msdcsc.exe 1016 msdcsc.exe 1428 msdcsc.exe 1428 msdcsc.exe 1716 msdcsc.exe 1716 msdcsc.exe 1148 msdcsc.exe 1148 msdcsc.exe 1644 msdcsc.exe 1644 msdcsc.exe 2004 msdcsc.exe 2004 msdcsc.exe 1240 msdcsc.exe 1240 msdcsc.exe 1100 msdcsc.exe 1100 msdcsc.exe 1940 msdcsc.exe 1940 msdcsc.exe 1444 msdcsc.exe 1444 msdcsc.exe 2032 msdcsc.exe 2032 msdcsc.exe 1632 msdcsc.exe 1632 msdcsc.exe 1964 msdcsc.exe 1964 msdcsc.exe 1656 msdcsc.exe 1656 msdcsc.exe 1368 msdcsc.exe 1368 msdcsc.exe 956 msdcsc.exe 956 msdcsc.exe 520 msdcsc.exe 520 msdcsc.exe 1056 msdcsc.exe 1056 msdcsc.exe 1504 msdcsc.exe 1504 msdcsc.exe 1452 msdcsc.exe 1452 msdcsc.exe -
Adds Run key to start application 2 TTPs 22 IoCs
Processes:
msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 22 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exedescription ioc process File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe -
Drops file in System32 directory 64 IoCs
Processes:
msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe -
Suspicious use of SetThreadContext 44 IoCs
Processes:
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exedescription pid process target process PID 2012 set thread context of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 820 set thread context of 668 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 1656 set thread context of 1320 1656 msdcsc.exe msdcsc.exe PID 1320 set thread context of 1232 1320 msdcsc.exe msdcsc.exe PID 1928 set thread context of 1528 1928 msdcsc.exe msdcsc.exe PID 1528 set thread context of 1016 1528 msdcsc.exe msdcsc.exe PID 2032 set thread context of 612 2032 msdcsc.exe msdcsc.exe PID 612 set thread context of 1428 612 msdcsc.exe msdcsc.exe PID 556 set thread context of 1932 556 msdcsc.exe msdcsc.exe PID 1932 set thread context of 1716 1932 msdcsc.exe msdcsc.exe PID 1176 set thread context of 2000 1176 msdcsc.exe msdcsc.exe PID 2000 set thread context of 1148 2000 msdcsc.exe msdcsc.exe PID 1168 set thread context of 1104 1168 msdcsc.exe msdcsc.exe PID 1104 set thread context of 1644 1104 msdcsc.exe msdcsc.exe PID 1980 set thread context of 1160 1980 msdcsc.exe msdcsc.exe PID 1160 set thread context of 2004 1160 msdcsc.exe msdcsc.exe PID 1656 set thread context of 1976 1656 msdcsc.exe msdcsc.exe PID 1976 set thread context of 1240 1976 msdcsc.exe msdcsc.exe PID 1952 set thread context of 1568 1952 msdcsc.exe msdcsc.exe PID 1568 set thread context of 1100 1568 msdcsc.exe msdcsc.exe PID 1356 set thread context of 1948 1356 msdcsc.exe msdcsc.exe PID 1948 set thread context of 1940 1948 msdcsc.exe msdcsc.exe PID 1696 set thread context of 1040 1696 msdcsc.exe msdcsc.exe PID 1040 set thread context of 1444 1040 msdcsc.exe msdcsc.exe PID 828 set thread context of 2008 828 msdcsc.exe msdcsc.exe PID 2008 set thread context of 2032 2008 msdcsc.exe msdcsc.exe PID 1168 set thread context of 1728 1168 msdcsc.exe msdcsc.exe PID 1728 set thread context of 1632 1728 msdcsc.exe msdcsc.exe PID 2016 set thread context of 1176 2016 msdcsc.exe msdcsc.exe PID 1176 set thread context of 1964 1176 msdcsc.exe msdcsc.exe PID 1452 set thread context of 1436 1452 msdcsc.exe msdcsc.exe PID 1436 set thread context of 1656 1436 msdcsc.exe msdcsc.exe PID 320 set thread context of 756 320 msdcsc.exe msdcsc.exe PID 756 set thread context of 1368 756 msdcsc.exe msdcsc.exe PID 1928 set thread context of 1684 1928 msdcsc.exe msdcsc.exe PID 1684 set thread context of 956 1684 msdcsc.exe msdcsc.exe PID 1140 set thread context of 1928 1140 msdcsc.exe msdcsc.exe PID 1928 set thread context of 520 1928 msdcsc.exe msdcsc.exe PID 1284 set thread context of 1536 1284 msdcsc.exe msdcsc.exe PID 1536 set thread context of 1056 1536 msdcsc.exe msdcsc.exe PID 824 set thread context of 1140 824 msdcsc.exe msdcsc.exe PID 1140 set thread context of 1504 1140 msdcsc.exe msdcsc.exe PID 1916 set thread context of 1504 1916 msdcsc.exe msdcsc.exe PID 1504 set thread context of 1452 1504 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 22 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 1696 PING.EXE 956 PING.EXE 632 PING.EXE 1952 PING.EXE 1696 PING.EXE 1728 PING.EXE 1536 PING.EXE 1404 PING.EXE 788 PING.EXE 1452 PING.EXE 996 PING.EXE 1356 PING.EXE 1684 PING.EXE 1928 PING.EXE 964 PING.EXE 1608 PING.EXE 1536 PING.EXE 1444 PING.EXE 296 PING.EXE 880 PING.EXE 296 PING.EXE 828 PING.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeSecurityPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeTakeOwnershipPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeLoadDriverPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeSystemProfilePrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeSystemtimePrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeProfSingleProcessPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeIncBasePriorityPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeCreatePagefilePrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeBackupPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeRestorePrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeShutdownPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeDebugPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeSystemEnvironmentPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeChangeNotifyPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeRemoteShutdownPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeUndockPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeManageVolumePrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeImpersonatePrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeCreateGlobalPrivilege 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: 33 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: 34 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: 35 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe Token: SeIncreaseQuotaPrivilege 1232 msdcsc.exe Token: SeSecurityPrivilege 1232 msdcsc.exe Token: SeTakeOwnershipPrivilege 1232 msdcsc.exe Token: SeLoadDriverPrivilege 1232 msdcsc.exe Token: SeSystemProfilePrivilege 1232 msdcsc.exe Token: SeSystemtimePrivilege 1232 msdcsc.exe Token: SeProfSingleProcessPrivilege 1232 msdcsc.exe Token: SeIncBasePriorityPrivilege 1232 msdcsc.exe Token: SeCreatePagefilePrivilege 1232 msdcsc.exe Token: SeBackupPrivilege 1232 msdcsc.exe Token: SeRestorePrivilege 1232 msdcsc.exe Token: SeShutdownPrivilege 1232 msdcsc.exe Token: SeDebugPrivilege 1232 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1232 msdcsc.exe Token: SeChangeNotifyPrivilege 1232 msdcsc.exe Token: SeRemoteShutdownPrivilege 1232 msdcsc.exe Token: SeUndockPrivilege 1232 msdcsc.exe Token: SeManageVolumePrivilege 1232 msdcsc.exe Token: SeImpersonatePrivilege 1232 msdcsc.exe Token: SeCreateGlobalPrivilege 1232 msdcsc.exe Token: 33 1232 msdcsc.exe Token: 34 1232 msdcsc.exe Token: 35 1232 msdcsc.exe Token: SeIncreaseQuotaPrivilege 1016 msdcsc.exe Token: SeSecurityPrivilege 1016 msdcsc.exe Token: SeTakeOwnershipPrivilege 1016 msdcsc.exe Token: SeLoadDriverPrivilege 1016 msdcsc.exe Token: SeSystemProfilePrivilege 1016 msdcsc.exe Token: SeSystemtimePrivilege 1016 msdcsc.exe Token: SeProfSingleProcessPrivilege 1016 msdcsc.exe Token: SeIncBasePriorityPrivilege 1016 msdcsc.exe Token: SeCreatePagefilePrivilege 1016 msdcsc.exe Token: SeBackupPrivilege 1016 msdcsc.exe Token: SeRestorePrivilege 1016 msdcsc.exe Token: SeShutdownPrivilege 1016 msdcsc.exe Token: SeDebugPrivilege 1016 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1016 msdcsc.exe Token: SeChangeNotifyPrivilege 1016 msdcsc.exe Token: SeRemoteShutdownPrivilege 1016 msdcsc.exe Token: SeUndockPrivilege 1016 msdcsc.exe Token: SeManageVolumePrivilege 1016 msdcsc.exe -
Suspicious use of SetWindowsHookEx 45 IoCs
Processes:
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exepid process 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe 1656 msdcsc.exe 1320 msdcsc.exe 1928 msdcsc.exe 1528 msdcsc.exe 2032 msdcsc.exe 612 msdcsc.exe 556 msdcsc.exe 1932 msdcsc.exe 1176 msdcsc.exe 2000 msdcsc.exe 1168 msdcsc.exe 1104 msdcsc.exe 1980 msdcsc.exe 1160 msdcsc.exe 1656 msdcsc.exe 1976 msdcsc.exe 1952 msdcsc.exe 1568 msdcsc.exe 1356 msdcsc.exe 1948 msdcsc.exe 1696 msdcsc.exe 1040 msdcsc.exe 828 msdcsc.exe 2008 msdcsc.exe 1168 msdcsc.exe 1728 msdcsc.exe 2016 msdcsc.exe 1176 msdcsc.exe 1452 msdcsc.exe 1436 msdcsc.exe 320 msdcsc.exe 756 msdcsc.exe 1928 msdcsc.exe 1684 msdcsc.exe 1140 msdcsc.exe 1928 msdcsc.exe 1284 msdcsc.exe 1536 msdcsc.exe 824 msdcsc.exe 1140 msdcsc.exe 1916 msdcsc.exe 1504 msdcsc.exe 1304 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.execmd.exemsdcsc.exemsdcsc.exemsdcsc.execmd.exemsdcsc.exedescription pid process target process PID 2012 wrote to memory of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 2012 wrote to memory of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 2012 wrote to memory of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 2012 wrote to memory of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 2012 wrote to memory of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 2012 wrote to memory of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 2012 wrote to memory of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 2012 wrote to memory of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 2012 wrote to memory of 820 2012 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 820 wrote to memory of 668 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 820 wrote to memory of 668 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 820 wrote to memory of 668 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 820 wrote to memory of 668 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 820 wrote to memory of 668 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 820 wrote to memory of 668 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 820 wrote to memory of 668 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 820 wrote to memory of 668 820 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe PID 668 wrote to memory of 1864 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe cmd.exe PID 668 wrote to memory of 1864 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe cmd.exe PID 668 wrote to memory of 1864 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe cmd.exe PID 668 wrote to memory of 1864 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe cmd.exe PID 668 wrote to memory of 1656 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe msdcsc.exe PID 668 wrote to memory of 1656 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe msdcsc.exe PID 668 wrote to memory of 1656 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe msdcsc.exe PID 668 wrote to memory of 1656 668 bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe msdcsc.exe PID 1864 wrote to memory of 996 1864 cmd.exe PING.EXE PID 1864 wrote to memory of 996 1864 cmd.exe PING.EXE PID 1864 wrote to memory of 996 1864 cmd.exe PING.EXE PID 1864 wrote to memory of 996 1864 cmd.exe PING.EXE PID 1656 wrote to memory of 1320 1656 msdcsc.exe msdcsc.exe PID 1656 wrote to memory of 1320 1656 msdcsc.exe msdcsc.exe PID 1656 wrote to memory of 1320 1656 msdcsc.exe msdcsc.exe PID 1656 wrote to memory of 1320 1656 msdcsc.exe msdcsc.exe PID 1656 wrote to memory of 1320 1656 msdcsc.exe msdcsc.exe PID 1656 wrote to memory of 1320 1656 msdcsc.exe msdcsc.exe PID 1656 wrote to memory of 1320 1656 msdcsc.exe msdcsc.exe PID 1656 wrote to memory of 1320 1656 msdcsc.exe msdcsc.exe PID 1656 wrote to memory of 1320 1656 msdcsc.exe msdcsc.exe PID 1320 wrote to memory of 1232 1320 msdcsc.exe msdcsc.exe PID 1320 wrote to memory of 1232 1320 msdcsc.exe msdcsc.exe PID 1320 wrote to memory of 1232 1320 msdcsc.exe msdcsc.exe PID 1320 wrote to memory of 1232 1320 msdcsc.exe msdcsc.exe PID 1320 wrote to memory of 1232 1320 msdcsc.exe msdcsc.exe PID 1320 wrote to memory of 1232 1320 msdcsc.exe msdcsc.exe PID 1320 wrote to memory of 1232 1320 msdcsc.exe msdcsc.exe PID 1320 wrote to memory of 1232 1320 msdcsc.exe msdcsc.exe PID 1232 wrote to memory of 1984 1232 msdcsc.exe cmd.exe PID 1232 wrote to memory of 1984 1232 msdcsc.exe cmd.exe PID 1232 wrote to memory of 1984 1232 msdcsc.exe cmd.exe PID 1232 wrote to memory of 1984 1232 msdcsc.exe cmd.exe PID 1232 wrote to memory of 1928 1232 msdcsc.exe msdcsc.exe PID 1232 wrote to memory of 1928 1232 msdcsc.exe msdcsc.exe PID 1232 wrote to memory of 1928 1232 msdcsc.exe msdcsc.exe PID 1232 wrote to memory of 1928 1232 msdcsc.exe msdcsc.exe PID 1984 wrote to memory of 828 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 828 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 828 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 828 1984 cmd.exe PING.EXE PID 1928 wrote to memory of 1528 1928 msdcsc.exe msdcsc.exe PID 1928 wrote to memory of 1528 1928 msdcsc.exe msdcsc.exe PID 1928 wrote to memory of 1528 1928 msdcsc.exe msdcsc.exe PID 1928 wrote to memory of 1528 1928 msdcsc.exe msdcsc.exe PID 1928 wrote to memory of 1528 1928 msdcsc.exe msdcsc.exe PID 1928 wrote to memory of 1528 1928 msdcsc.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"3⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"4⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 45⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"6⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 48⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"8⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"9⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"10⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 411⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"11⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"13⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 414⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"14⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"15⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"16⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 417⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"17⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"18⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"19⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 420⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"20⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"21⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"22⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 423⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"23⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"24⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"25⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 426⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"26⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"27⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"28⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 429⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"28⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"29⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"30⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"31⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 432⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"32⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"33⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"34⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 435⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"34⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"35⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"36⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"37⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 438⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"38⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"39⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"40⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 441⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"40⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"41⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"42⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"43⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 444⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"44⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"45⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"46⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 447⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"46⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"47⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"48⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"49⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 450⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"50⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"51⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"52⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 453⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"52⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"53⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"54⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"55⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 456⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"56⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"57⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"58⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 459⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"58⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"59⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"60⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"61⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 462⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"62⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"63⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"64⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 465⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"64⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"65⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"66⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"67⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 468⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"67⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
728KB
MD5c08b5c86a6862dce171417d4784a8e9d
SHA158c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
-
memory/516-256-0x0000000000000000-mapping.dmp
-
memory/520-653-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/556-189-0x0000000000000000-mapping.dmp
-
memory/612-182-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/612-168-0x0000000000401844-mapping.dmp
-
memory/668-75-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/668-77-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/668-74-0x00000000004B2590-mapping.dmp
-
memory/668-73-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/668-71-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/668-69-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/668-78-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/668-79-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/668-68-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/668-86-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/756-600-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/820-76-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/820-57-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/820-58-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/820-60-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/820-63-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/820-64-0x0000000000401844-mapping.dmp
-
memory/828-469-0x0000000000000000-mapping.dmp
-
memory/828-124-0x0000000000000000-mapping.dmp
-
memory/956-473-0x0000000000000000-mapping.dmp
-
memory/956-629-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/996-89-0x0000000000000000-mapping.dmp
-
memory/1016-157-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1016-144-0x00000000004B2590-mapping.dmp
-
memory/1016-149-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1016-150-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1040-462-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1040-448-0x0000000000401844-mapping.dmp
-
memory/1056-678-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1092-221-0x0000000000000000-mapping.dmp
-
memory/1100-402-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1100-389-0x00000000004B2590-mapping.dmp
-
memory/1104-287-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1104-273-0x0000000000401844-mapping.dmp
-
memory/1128-396-0x0000000000000000-mapping.dmp
-
memory/1148-249-0x00000000004B2590-mapping.dmp
-
memory/1148-255-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1148-260-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1160-308-0x0000000000401844-mapping.dmp
-
memory/1160-323-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1168-504-0x0000000000000000-mapping.dmp
-
memory/1168-259-0x0000000000000000-mapping.dmp
-
memory/1176-224-0x0000000000000000-mapping.dmp
-
memory/1208-361-0x0000000000000000-mapping.dmp
-
memory/1232-113-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1232-114-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1232-109-0x00000000004B2590-mapping.dmp
-
memory/1232-121-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1240-354-0x00000000004B2590-mapping.dmp
-
memory/1240-365-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1320-98-0x0000000000401844-mapping.dmp
-
memory/1320-125-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1356-399-0x0000000000000000-mapping.dmp
-
memory/1356-265-0x0000000000000000-mapping.dmp
-
memory/1368-604-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1428-179-0x00000000004B2590-mapping.dmp
-
memory/1428-192-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1444-459-0x00000000004B2590-mapping.dmp
-
memory/1444-472-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1444-335-0x0000000000000000-mapping.dmp
-
memory/1452-730-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1504-725-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1504-702-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1504-703-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1528-133-0x0000000000401844-mapping.dmp
-
memory/1528-147-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1536-405-0x0000000000000000-mapping.dmp
-
memory/1536-674-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1536-195-0x0000000000000000-mapping.dmp
-
memory/1568-378-0x0000000000401844-mapping.dmp
-
memory/1568-393-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1604-151-0x0000000000000000-mapping.dmp
-
memory/1608-230-0x0000000000000000-mapping.dmp
-
memory/1620-291-0x0000000000000000-mapping.dmp
-
memory/1632-532-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1640-326-0x0000000000000000-mapping.dmp
-
memory/1644-284-0x00000000004B2590-mapping.dmp
-
memory/1644-298-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1656-579-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1656-329-0x0000000000000000-mapping.dmp
-
memory/1656-83-0x0000000000000000-mapping.dmp
-
memory/1684-626-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1684-438-0x0000000000000000-mapping.dmp
-
memory/1696-433-0x0000000000000000-mapping.dmp
-
memory/1696-296-0x0000000000000000-mapping.dmp
-
memory/1696-367-0x0000000000000000-mapping.dmp
-
memory/1716-218-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1716-226-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1716-214-0x00000000004B2590-mapping.dmp
-
memory/1728-527-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1728-159-0x0000000000000000-mapping.dmp
-
memory/1764-186-0x0000000000000000-mapping.dmp
-
memory/1812-466-0x0000000000000000-mapping.dmp
-
memory/1864-80-0x0000000000000000-mapping.dmp
-
memory/1900-501-0x0000000000000000-mapping.dmp
-
memory/1928-118-0x0000000000000000-mapping.dmp
-
memory/1932-203-0x0000000000401844-mapping.dmp
-
memory/1940-436-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1940-424-0x00000000004B2590-mapping.dmp
-
memory/1948-413-0x0000000000401844-mapping.dmp
-
memory/1948-440-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1952-364-0x0000000000000000-mapping.dmp
-
memory/1964-555-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1976-358-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1976-343-0x0000000000401844-mapping.dmp
-
memory/1980-294-0x0000000000000000-mapping.dmp
-
memory/1984-115-0x0000000000000000-mapping.dmp
-
memory/2000-238-0x0000000000401844-mapping.dmp
-
memory/2004-319-0x00000000004B2590-mapping.dmp
-
memory/2004-332-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2008-499-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2008-483-0x0000000000401844-mapping.dmp
-
memory/2012-54-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/2020-430-0x0000000000000000-mapping.dmp
-
memory/2032-154-0x0000000000000000-mapping.dmp
-
memory/2032-507-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2032-494-0x00000000004B2590-mapping.dmp