darkcomet | bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Size

728KB
MD5

c08b5c86a6862dce171417d4784a8e9d
SHA1

58c7a720b3fbf7473a9c3fd278ba243545223aea
SHA256

bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6
SHA512

f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c
SSDEEP

12288:Ykn1cJbceCA9W+DoGSSPI1YEoaPwJjoAOJq+QeiiGWM6wGAizk/Jq+QeiiGWM6wd:YGqI9A9WLjSPPEoMwJjoAD+QeiiGN8pq

Score

10^/10

darkcomet bootkit persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 22 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Executes dropped EXE 64 IoCs

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

pid	process
4332	msdcsc.exe
4228	msdcsc.exe
4956	msdcsc.exe
5100	msdcsc.exe
4924	msdcsc.exe
1188	msdcsc.exe
4192	msdcsc.exe
2568	msdcsc.exe
1616	msdcsc.exe
2696	msdcsc.exe
2480	msdcsc.exe
4320	msdcsc.exe
3340	msdcsc.exe
1808	msdcsc.exe
4332	msdcsc.exe
60	msdcsc.exe
5100	msdcsc.exe
176	msdcsc.exe
4464	msdcsc.exe
332	msdcsc.exe
4336	msdcsc.exe
1456	msdcsc.exe
2032	msdcsc.exe
4500	msdcsc.exe
3508	msdcsc.exe
2088	msdcsc.exe
4360	msdcsc.exe
4860	msdcsc.exe
2924	msdcsc.exe
4948	msdcsc.exe
2804	msdcsc.exe
1276	msdcsc.exe
4144	msdcsc.exe
1520	msdcsc.exe
220	msdcsc.exe
4708	msdcsc.exe
5008	msdcsc.exe
3748	msdcsc.exe
5068	msdcsc.exe
884	msdcsc.exe
4528	msdcsc.exe
1660	msdcsc.exe
4028	msdcsc.exe
5060	msdcsc.exe
1212	msdcsc.exe
3068	msdcsc.exe
3760	msdcsc.exe
1112	msdcsc.exe
4268	msdcsc.exe
4068	msdcsc.exe
1128	msdcsc.exe
2284	msdcsc.exe
3088	msdcsc.exe
2244	msdcsc.exe
3700	msdcsc.exe
1648	msdcsc.exe
4012	msdcsc.exe
848	msdcsc.exe
3084	msdcsc.exe
3480	msdcsc.exe
1692	msdcsc.exe
1316	msdcsc.exe
4860	msdcsc.exe
3460	msdcsc.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4740-141-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4740-142-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4740-143-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4740-144-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4740-146-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4740-147-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4740-152-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4956-168-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4956-170-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4956-175-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1188-189-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1188-190-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1188-192-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1188-193-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1188-198-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1616-213-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1616-215-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1616-220-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4320-236-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4320-241-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4332-258-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4332-259-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4332-264-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/176-285-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4336-300-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4336-302-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4336-303-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4336-308-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4500-324-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4500-326-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4500-332-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4360-354-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4948-375-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4144-394-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4708-413-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4708-418-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/5068-435-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1660-450-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1212-466-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1112-485-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1128-501-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/2244-516-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4012-533-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/3480-549-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4860-563-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/4860-565-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Checks computer location settings 2 TTPs 22 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msdcsc.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	msdcsc.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 22 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

description	ioc	process
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe
File opened for modification	\??\PhysicalDrive0	msdcsc.exe

Drops file in System32 directory 64 IoCs

Processes:

msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	msdcsc.exe

Suspicious use of SetThreadContext 44 IoCs

Processes:

bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe

description	pid	process	target process
PID 1644 set thread context of 1868	1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1868 set thread context of 4740	1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 4332 set thread context of 4228	4332	msdcsc.exe	msdcsc.exe
PID 4228 set thread context of 4956	4228	msdcsc.exe	msdcsc.exe
PID 5100 set thread context of 4924	5100	msdcsc.exe	msdcsc.exe
PID 4924 set thread context of 1188	4924	msdcsc.exe	msdcsc.exe
PID 4192 set thread context of 2568	4192	msdcsc.exe	msdcsc.exe
PID 2568 set thread context of 1616	2568	msdcsc.exe	msdcsc.exe
PID 2696 set thread context of 2480	2696	msdcsc.exe	msdcsc.exe
PID 2480 set thread context of 4320	2480	msdcsc.exe	msdcsc.exe
PID 3340 set thread context of 1808	3340	msdcsc.exe	msdcsc.exe
PID 1808 set thread context of 4332	1808	msdcsc.exe	msdcsc.exe
PID 60 set thread context of 5100	60	msdcsc.exe	msdcsc.exe
PID 5100 set thread context of 176	5100	msdcsc.exe	msdcsc.exe
PID 4464 set thread context of 332	4464	msdcsc.exe	msdcsc.exe
PID 332 set thread context of 4336	332	msdcsc.exe	msdcsc.exe
PID 1456 set thread context of 2032	1456	msdcsc.exe	msdcsc.exe
PID 2032 set thread context of 4500	2032	msdcsc.exe	msdcsc.exe
PID 3508 set thread context of 2088	3508	msdcsc.exe	msdcsc.exe
PID 2088 set thread context of 4360	2088	msdcsc.exe	msdcsc.exe
PID 4860 set thread context of 2924	4860	msdcsc.exe	msdcsc.exe
PID 2924 set thread context of 4948	2924	msdcsc.exe	msdcsc.exe
PID 2804 set thread context of 1276	2804	msdcsc.exe	msdcsc.exe
PID 1276 set thread context of 4144	1276	msdcsc.exe	msdcsc.exe
PID 1520 set thread context of 220	1520	msdcsc.exe	msdcsc.exe
PID 220 set thread context of 4708	220	msdcsc.exe	msdcsc.exe
PID 5008 set thread context of 3748	5008	msdcsc.exe	msdcsc.exe
PID 3748 set thread context of 5068	3748	msdcsc.exe	msdcsc.exe
PID 884 set thread context of 4528	884	msdcsc.exe	msdcsc.exe
PID 4528 set thread context of 1660	4528	msdcsc.exe	msdcsc.exe
PID 4028 set thread context of 5060	4028	msdcsc.exe	msdcsc.exe
PID 5060 set thread context of 1212	5060	msdcsc.exe	msdcsc.exe
PID 3068 set thread context of 3760	3068	msdcsc.exe	msdcsc.exe
PID 3760 set thread context of 1112	3760	msdcsc.exe	msdcsc.exe
PID 4268 set thread context of 4068	4268	msdcsc.exe	msdcsc.exe
PID 4068 set thread context of 1128	4068	msdcsc.exe	msdcsc.exe
PID 2284 set thread context of 3088	2284	msdcsc.exe	msdcsc.exe
PID 3088 set thread context of 2244	3088	msdcsc.exe	msdcsc.exe
PID 3700 set thread context of 1648	3700	msdcsc.exe	msdcsc.exe
PID 1648 set thread context of 4012	1648	msdcsc.exe	msdcsc.exe
PID 848 set thread context of 3084	848	msdcsc.exe	msdcsc.exe
PID 3084 set thread context of 3480	3084	msdcsc.exe	msdcsc.exe
PID 1692 set thread context of 1316	1692	msdcsc.exe	msdcsc.exe
PID 1316 set thread context of 4860	1316	msdcsc.exe	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 22 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
2700	PING.EXE
616	PING.EXE
1768	PING.EXE
1292	PING.EXE
5044	PING.EXE
756	PING.EXE
3392	PING.EXE
3000	PING.EXE
3444	PING.EXE
1312	PING.EXE
4612	PING.EXE
4108	PING.EXE
4316	PING.EXE
2924	PING.EXE
1888	PING.EXE
848	PING.EXE
3380	PING.EXE
924	PING.EXE
4152	PING.EXE
4712	PING.EXE
1540	PING.EXE
3496	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exemsdcsc.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeSecurityPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeTakeOwnershipPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeLoadDriverPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeSystemProfilePrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeSystemtimePrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeProfSingleProcessPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeIncBasePriorityPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeCreatePagefilePrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeBackupPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeRestorePrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeShutdownPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeDebugPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeSystemEnvironmentPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeChangeNotifyPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeRemoteShutdownPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeUndockPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeManageVolumePrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeImpersonatePrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeCreateGlobalPrivilege	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: 33	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: 34	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: 35	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: 36	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
Token: SeIncreaseQuotaPrivilege	4956	msdcsc.exe
Token: SeSecurityPrivilege	4956	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4956	msdcsc.exe
Token: SeLoadDriverPrivilege	4956	msdcsc.exe
Token: SeSystemProfilePrivilege	4956	msdcsc.exe
Token: SeSystemtimePrivilege	4956	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4956	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4956	msdcsc.exe
Token: SeCreatePagefilePrivilege	4956	msdcsc.exe
Token: SeBackupPrivilege	4956	msdcsc.exe
Token: SeRestorePrivilege	4956	msdcsc.exe
Token: SeShutdownPrivilege	4956	msdcsc.exe
Token: SeDebugPrivilege	4956	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4956	msdcsc.exe
Token: SeChangeNotifyPrivilege	4956	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4956	msdcsc.exe
Token: SeUndockPrivilege	4956	msdcsc.exe
Token: SeManageVolumePrivilege	4956	msdcsc.exe
Token: SeImpersonatePrivilege	4956	msdcsc.exe
Token: SeCreateGlobalPrivilege	4956	msdcsc.exe
Token: 33	4956	msdcsc.exe
Token: 34	4956	msdcsc.exe
Token: 35	4956	msdcsc.exe
Token: 36	4956	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	1188	msdcsc.exe
Token: SeSecurityPrivilege	1188	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1188	msdcsc.exe
Token: SeLoadDriverPrivilege	1188	msdcsc.exe
Token: SeSystemProfilePrivilege	1188	msdcsc.exe
Token: SeSystemtimePrivilege	1188	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1188	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1188	msdcsc.exe
Token: SeCreatePagefilePrivilege	1188	msdcsc.exe
Token: SeBackupPrivilege	1188	msdcsc.exe
Token: SeRestorePrivilege	1188	msdcsc.exe
Token: SeShutdownPrivilege	1188	msdcsc.exe
Token: SeDebugPrivilege	1188	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1188	msdcsc.exe
Token: SeChangeNotifyPrivilege	1188	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1188	msdcsc.exe

Suspicious use of SetWindowsHookEx 45 IoCs

Processes:

pid	process
1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
4332	msdcsc.exe
4228	msdcsc.exe
5100	msdcsc.exe
4924	msdcsc.exe
4192	msdcsc.exe
2568	msdcsc.exe
2696	msdcsc.exe
2480	msdcsc.exe
3340	msdcsc.exe
1808	msdcsc.exe
60	msdcsc.exe
5100	msdcsc.exe
4464	msdcsc.exe
332	msdcsc.exe
1456	msdcsc.exe
2032	msdcsc.exe
3508	msdcsc.exe
2088	msdcsc.exe
4860	msdcsc.exe
2924	msdcsc.exe
2804	msdcsc.exe
1276	msdcsc.exe
1520	msdcsc.exe
220	msdcsc.exe
5008	msdcsc.exe
3748	msdcsc.exe
884	msdcsc.exe
4528	msdcsc.exe
4028	msdcsc.exe
5060	msdcsc.exe
3068	msdcsc.exe
3760	msdcsc.exe
4268	msdcsc.exe
4068	msdcsc.exe
2284	msdcsc.exe
3088	msdcsc.exe
3700	msdcsc.exe
1648	msdcsc.exe
848	msdcsc.exe
3084	msdcsc.exe
1692	msdcsc.exe
1316	msdcsc.exe
3460	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exebffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.execmd.exemsdcsc.exemsdcsc.exemsdcsc.execmd.exemsdcsc.exemsdcsc.exe

description	pid	process	target process
PID 1644 wrote to memory of 1868	1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1644 wrote to memory of 1868	1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1644 wrote to memory of 1868	1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1644 wrote to memory of 1868	1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1644 wrote to memory of 1868	1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1644 wrote to memory of 1868	1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1644 wrote to memory of 1868	1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1644 wrote to memory of 1868	1644	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1868 wrote to memory of 4740	1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1868 wrote to memory of 4740	1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1868 wrote to memory of 4740	1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1868 wrote to memory of 4740	1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1868 wrote to memory of 4740	1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1868 wrote to memory of 4740	1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1868 wrote to memory of 4740	1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 1868 wrote to memory of 4740	1868	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
PID 4740 wrote to memory of 2960	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	cmd.exe
PID 4740 wrote to memory of 2960	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	cmd.exe
PID 4740 wrote to memory of 2960	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	cmd.exe
PID 4740 wrote to memory of 4332	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	msdcsc.exe
PID 4740 wrote to memory of 4332	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	msdcsc.exe
PID 4740 wrote to memory of 4332	4740	bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe	msdcsc.exe
PID 2960 wrote to memory of 4152	2960	cmd.exe	PING.EXE
PID 2960 wrote to memory of 4152	2960	cmd.exe	PING.EXE
PID 2960 wrote to memory of 4152	2960	cmd.exe	PING.EXE
PID 4332 wrote to memory of 4228	4332	msdcsc.exe	msdcsc.exe
PID 4332 wrote to memory of 4228	4332	msdcsc.exe	msdcsc.exe
PID 4332 wrote to memory of 4228	4332	msdcsc.exe	msdcsc.exe
PID 4332 wrote to memory of 4228	4332	msdcsc.exe	msdcsc.exe
PID 4332 wrote to memory of 4228	4332	msdcsc.exe	msdcsc.exe
PID 4332 wrote to memory of 4228	4332	msdcsc.exe	msdcsc.exe
PID 4332 wrote to memory of 4228	4332	msdcsc.exe	msdcsc.exe
PID 4332 wrote to memory of 4228	4332	msdcsc.exe	msdcsc.exe
PID 4228 wrote to memory of 4956	4228	msdcsc.exe	msdcsc.exe
PID 4228 wrote to memory of 4956	4228	msdcsc.exe	msdcsc.exe
PID 4228 wrote to memory of 4956	4228	msdcsc.exe	msdcsc.exe
PID 4228 wrote to memory of 4956	4228	msdcsc.exe	msdcsc.exe
PID 4228 wrote to memory of 4956	4228	msdcsc.exe	msdcsc.exe
PID 4228 wrote to memory of 4956	4228	msdcsc.exe	msdcsc.exe
PID 4228 wrote to memory of 4956	4228	msdcsc.exe	msdcsc.exe
PID 4228 wrote to memory of 4956	4228	msdcsc.exe	msdcsc.exe
PID 4956 wrote to memory of 1468	4956	msdcsc.exe	cmd.exe
PID 4956 wrote to memory of 1468	4956	msdcsc.exe	cmd.exe
PID 4956 wrote to memory of 1468	4956	msdcsc.exe	cmd.exe
PID 4956 wrote to memory of 5100	4956	msdcsc.exe	msdcsc.exe
PID 4956 wrote to memory of 5100	4956	msdcsc.exe	msdcsc.exe
PID 4956 wrote to memory of 5100	4956	msdcsc.exe	msdcsc.exe
PID 1468 wrote to memory of 756	1468	cmd.exe	PING.EXE
PID 1468 wrote to memory of 756	1468	cmd.exe	PING.EXE
PID 1468 wrote to memory of 756	1468	cmd.exe	PING.EXE
PID 5100 wrote to memory of 4924	5100	msdcsc.exe	msdcsc.exe
PID 5100 wrote to memory of 4924	5100	msdcsc.exe	msdcsc.exe
PID 5100 wrote to memory of 4924	5100	msdcsc.exe	msdcsc.exe
PID 5100 wrote to memory of 4924	5100	msdcsc.exe	msdcsc.exe
PID 5100 wrote to memory of 4924	5100	msdcsc.exe	msdcsc.exe
PID 5100 wrote to memory of 4924	5100	msdcsc.exe	msdcsc.exe
PID 5100 wrote to memory of 4924	5100	msdcsc.exe	msdcsc.exe
PID 5100 wrote to memory of 4924	5100	msdcsc.exe	msdcsc.exe
PID 4924 wrote to memory of 1188	4924	msdcsc.exe	msdcsc.exe
PID 4924 wrote to memory of 1188	4924	msdcsc.exe	msdcsc.exe
PID 4924 wrote to memory of 1188	4924	msdcsc.exe	msdcsc.exe
PID 4924 wrote to memory of 1188	4924	msdcsc.exe	msdcsc.exe
PID 4924 wrote to memory of 1188	4924	msdcsc.exe	msdcsc.exe
PID 4924 wrote to memory of 1188	4924	msdcsc.exe	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
"C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
"C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe
"C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"
3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
5⤵
- Runs ping.exe
PID:4152

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
6⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
7⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
8⤵
- Runs ping.exe
PID:756

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
8⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
9⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
10⤵
PID:2112

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
11⤵
- Runs ping.exe
PID:3392

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
11⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2568

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:1616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
13⤵
PID:3660

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
14⤵
- Runs ping.exe
PID:2700

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2696

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
14⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2480

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
15⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
16⤵
PID:3928

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
17⤵
- Runs ping.exe
PID:2924

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3340

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
17⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1808

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
18⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4332

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
19⤵
PID:4040

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
20⤵
- Runs ping.exe
PID:3000

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:60

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
20⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:5100

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
21⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
22⤵
PID:3728

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
23⤵
- Runs ping.exe
PID:3444

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4464

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
23⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:332

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
24⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
25⤵
PID:2232

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
26⤵
- Runs ping.exe
PID:616

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1456

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
26⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2032

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
27⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4500

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
28⤵
PID:4744

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
29⤵
- Runs ping.exe
PID:4712

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
28⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3508

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
29⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2088

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
30⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4360

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4860

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
32⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2924

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
33⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
34⤵
PID:3720

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
35⤵
- Runs ping.exe
PID:1540

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
34⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2804

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
35⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
36⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4144

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
37⤵
PID:1964

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
38⤵
- Runs ping.exe
PID:1888

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1520

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
38⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:220

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
39⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
40⤵
PID:4464

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
41⤵
- Runs ping.exe
PID:1768

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
40⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:5008

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
41⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3748

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
42⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:5068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
43⤵
PID:2236

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
44⤵
- Runs ping.exe
PID:848

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:884

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
44⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
45⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:1660

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
46⤵
PID:2772

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
47⤵
- Runs ping.exe
PID:1292

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
46⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4028

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
47⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:5060

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
48⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:1212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
49⤵
PID:2040

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
50⤵
- Runs ping.exe
PID:5044

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3068

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
50⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3760

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
51⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:1112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
52⤵
PID:3340

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
53⤵
- Runs ping.exe
PID:3380

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
52⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4268

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
53⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4068

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
54⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:1128

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
55⤵
PID:4224

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
56⤵
- Runs ping.exe
PID:3496

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2284

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
56⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3088

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
57⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:2244

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
58⤵
PID:2424

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
59⤵
- Runs ping.exe
PID:924

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
58⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3700

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
59⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
60⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4012

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
61⤵
PID:1792

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
62⤵
- Runs ping.exe
PID:4612

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:848

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
62⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3084

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
63⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:3480

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
64⤵
PID:3272

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
65⤵
- Runs ping.exe
PID:4108

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
64⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1692

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
65⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
66⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:4860

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
67⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
67⤵
PID:4524

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
68⤵
- Runs ping.exe
PID:4316

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"
31⤵
PID:1656

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 4
32⤵
- Runs ping.exe
PID:1312

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
728KB

MD5
c08b5c86a6862dce171417d4784a8e9d

SHA1
58c7a720b3fbf7473a9c3fd278ba243545223aea

SHA256
bffa28e7f39ce53d1b1810750b7663faa4d1dc5c1177b72c1a962367edd62cf6

SHA512
f2cff54c4b2173b64d41053fe231a36eeda6c700c35a26282596b1f4f9c79f46e58be1c3a21b1dbcfb1b8ac1d85d2307ebc6238521b85f9ded64b8a5055cc33c

Download Submit
memory/60-261-0x0000000000000000-mapping.dmp

Download
memory/176-285-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/176-274-0x0000000000000000-mapping.dmp

Download
memory/220-400-0x0000000000000000-mapping.dmp

Download
memory/220-412-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/332-289-0x0000000000000000-mapping.dmp

Download
memory/332-312-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/332-301-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/616-311-0x0000000000000000-mapping.dmp

Download
memory/756-177-0x0000000000000000-mapping.dmp

Download
memory/1112-485-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1128-501-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1188-190-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1188-198-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1188-185-0x0000000000000000-mapping.dmp

Download
memory/1188-193-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1188-189-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1188-192-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1212-466-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1276-379-0x0000000000000000-mapping.dmp

Download
memory/1276-396-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1276-421-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1312-356-0x0000000000000000-mapping.dmp

Download
memory/1316-562-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1456-305-0x0000000000000000-mapping.dmp

Download
memory/1468-171-0x0000000000000000-mapping.dmp

Download
memory/1520-392-0x0000000000000000-mapping.dmp

Download
memory/1540-376-0x0000000000000000-mapping.dmp

Download
memory/1616-213-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1616-209-0x0000000000000000-mapping.dmp

Download
memory/1616-220-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1616-215-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1644-132-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1648-529-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1656-350-0x0000000000000000-mapping.dmp

Download
memory/1660-450-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1808-255-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1808-245-0x0000000000000000-mapping.dmp

Download
memory/1868-135-0x0000000000000000-mapping.dmp

Download
memory/1868-136-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1868-145-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1888-397-0x0000000000000000-mapping.dmp

Download
memory/1964-391-0x0000000000000000-mapping.dmp

Download
memory/2032-313-0x0000000000000000-mapping.dmp

Download
memory/2032-325-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2032-327-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2088-336-0x0000000000000000-mapping.dmp

Download
memory/2088-348-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2088-342-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2112-194-0x0000000000000000-mapping.dmp

Download
memory/2232-304-0x0000000000000000-mapping.dmp

Download
memory/2244-516-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2480-224-0x0000000000000000-mapping.dmp

Download
memory/2480-235-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2568-214-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2568-203-0x0000000000000000-mapping.dmp

Download
memory/2696-217-0x0000000000000000-mapping.dmp

Download
memory/2700-223-0x0000000000000000-mapping.dmp

Download
memory/2804-372-0x0000000000000000-mapping.dmp

Download
memory/2924-244-0x0000000000000000-mapping.dmp

Download
memory/2924-358-0x0000000000000000-mapping.dmp

Download
memory/2924-369-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2960-148-0x0000000000000000-mapping.dmp

Download
memory/3000-266-0x0000000000000000-mapping.dmp

Download
memory/3084-545-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3088-519-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3340-238-0x0000000000000000-mapping.dmp

Download
memory/3392-201-0x0000000000000000-mapping.dmp

Download
memory/3444-288-0x0000000000000000-mapping.dmp

Download
memory/3480-549-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3508-329-0x0000000000000000-mapping.dmp

Download
memory/3660-216-0x0000000000000000-mapping.dmp

Download
memory/3720-371-0x0000000000000000-mapping.dmp

Download
memory/3728-281-0x0000000000000000-mapping.dmp

Download
memory/3748-433-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3760-482-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3928-237-0x0000000000000000-mapping.dmp

Download
memory/4012-533-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4040-260-0x0000000000000000-mapping.dmp

Download
memory/4068-497-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4144-385-0x0000000000000000-mapping.dmp

Download
memory/4144-394-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4152-155-0x0000000000000000-mapping.dmp

Download
memory/4192-195-0x0000000000000000-mapping.dmp

Download
memory/4228-157-0x0000000000000000-mapping.dmp

Download
memory/4228-163-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4228-169-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4320-241-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4320-236-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4320-230-0x0000000000000000-mapping.dmp

Download
memory/4332-149-0x0000000000000000-mapping.dmp

Download
memory/4332-264-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4332-153-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4332-258-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4332-259-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4332-251-0x0000000000000000-mapping.dmp

Download
memory/4336-302-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4336-303-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4336-300-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4336-308-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4336-295-0x0000000000000000-mapping.dmp

Download
memory/4360-343-0x0000000000000000-mapping.dmp

Download
memory/4360-354-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4464-414-0x0000000000000000-mapping.dmp

Download
memory/4464-282-0x0000000000000000-mapping.dmp

Download
memory/4500-319-0x0000000000000000-mapping.dmp

Download
memory/4500-332-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4500-326-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4500-324-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4528-453-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4528-471-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4708-418-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4708-406-0x0000000000000000-mapping.dmp

Download
memory/4708-413-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4712-334-0x0000000000000000-mapping.dmp

Download
memory/4740-142-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4740-147-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4740-140-0x0000000000000000-mapping.dmp

Download
memory/4740-141-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4740-152-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4740-143-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4740-144-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4740-146-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4744-328-0x0000000000000000-mapping.dmp

Download
memory/4860-565-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4860-563-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4860-351-0x0000000000000000-mapping.dmp

Download
memory/4924-191-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4924-179-0x0000000000000000-mapping.dmp

Download
memory/4924-202-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4948-375-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4948-364-0x0000000000000000-mapping.dmp

Download
memory/4956-170-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4956-168-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4956-164-0x0000000000000000-mapping.dmp

Download
memory/4956-175-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5008-415-0x0000000000000000-mapping.dmp

Download
memory/5060-469-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5060-470-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5068-435-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/5100-268-0x0000000000000000-mapping.dmp

Download
memory/5100-172-0x0000000000000000-mapping.dmp

Download
memory/5100-278-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download