darkcomet | b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0

Analysis

max time kernel
150s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe
Size

834KB
MD5

642cc235b6552c524c89441d23053420
SHA1

64ea644a56e14d2062f76374176785a45515b9fd
SHA256

b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0
SHA512

1ade8c82a148496a47c46dc3567deb20a98d512ead13f5cf533d22ef0fbfbcaf2c9ad691c95717d956533875ec0f6aafc68764842f00129b1370cd3b25d49883
SSDEEP

24576:jG94QklbgNXrs5jkPENZI9k6Ts84PCx7/NBEn:jg4owbZI7cPc7Un

Score

10^/10

darkcomet guest2 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest2

myvault.no-ip.info:999

Mutex

DC_MUTEX-ZCH6G3K

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
L8vg77ELMAXt
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

5.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\MSDCSC\\msdcsc.exe"	5.EXE

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msdcsc.exe

Executes dropped EXE 2 IoCs

Processes:

5.EXEmsdcsc.exe

pid process

460 5.EXE
1688 msdcsc.exe
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

944 attrib.exe
1576 attrib.exe

pid	process
460	5.EXE
1688	msdcsc.exe

pid	process
944	attrib.exe
1576	attrib.exe

Loads dropped DLL 4 IoCs

Processes:

b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe5.EXE

pid	process
828	b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe
828	b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe
460	5.EXE
460	5.EXE

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msdcsc.exe5.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\MSDCSC\\msdcsc.exe"	5.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

1688 msdcsc.exe

pid	process
1688	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

5.EXEmsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	460	5.EXE
Token: SeSecurityPrivilege	460	5.EXE
Token: SeTakeOwnershipPrivilege	460	5.EXE
Token: SeLoadDriverPrivilege	460	5.EXE
Token: SeSystemProfilePrivilege	460	5.EXE
Token: SeSystemtimePrivilege	460	5.EXE
Token: SeProfSingleProcessPrivilege	460	5.EXE
Token: SeIncBasePriorityPrivilege	460	5.EXE
Token: SeCreatePagefilePrivilege	460	5.EXE
Token: SeBackupPrivilege	460	5.EXE
Token: SeRestorePrivilege	460	5.EXE
Token: SeShutdownPrivilege	460	5.EXE
Token: SeDebugPrivilege	460	5.EXE
Token: SeSystemEnvironmentPrivilege	460	5.EXE
Token: SeChangeNotifyPrivilege	460	5.EXE
Token: SeRemoteShutdownPrivilege	460	5.EXE
Token: SeUndockPrivilege	460	5.EXE
Token: SeManageVolumePrivilege	460	5.EXE
Token: SeImpersonatePrivilege	460	5.EXE
Token: SeCreateGlobalPrivilege	460	5.EXE
Token: 33	460	5.EXE
Token: 34	460	5.EXE
Token: 35	460	5.EXE
Token: SeIncreaseQuotaPrivilege	1688	msdcsc.exe
Token: SeSecurityPrivilege	1688	msdcsc.exe
Token: SeTakeOwnershipPrivilege	1688	msdcsc.exe
Token: SeLoadDriverPrivilege	1688	msdcsc.exe
Token: SeSystemProfilePrivilege	1688	msdcsc.exe
Token: SeSystemtimePrivilege	1688	msdcsc.exe
Token: SeProfSingleProcessPrivilege	1688	msdcsc.exe
Token: SeIncBasePriorityPrivilege	1688	msdcsc.exe
Token: SeCreatePagefilePrivilege	1688	msdcsc.exe
Token: SeBackupPrivilege	1688	msdcsc.exe
Token: SeRestorePrivilege	1688	msdcsc.exe
Token: SeShutdownPrivilege	1688	msdcsc.exe
Token: SeDebugPrivilege	1688	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	1688	msdcsc.exe
Token: SeChangeNotifyPrivilege	1688	msdcsc.exe
Token: SeRemoteShutdownPrivilege	1688	msdcsc.exe
Token: SeUndockPrivilege	1688	msdcsc.exe
Token: SeManageVolumePrivilege	1688	msdcsc.exe
Token: SeImpersonatePrivilege	1688	msdcsc.exe
Token: SeCreateGlobalPrivilege	1688	msdcsc.exe
Token: 33	1688	msdcsc.exe
Token: 34	1688	msdcsc.exe
Token: 35	1688	msdcsc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

892 DllHost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

1688 msdcsc.exe

pid	process
892	DllHost.exe

pid	process
1688	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe5.EXEcmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 828 wrote to memory of 460	828	b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe	5.EXE
PID 828 wrote to memory of 460	828	b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe	5.EXE
PID 828 wrote to memory of 460	828	b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe	5.EXE
PID 828 wrote to memory of 460	828	b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe	5.EXE
PID 460 wrote to memory of 1488	460	5.EXE	cmd.exe
PID 460 wrote to memory of 1488	460	5.EXE	cmd.exe
PID 460 wrote to memory of 1488	460	5.EXE	cmd.exe
PID 460 wrote to memory of 1488	460	5.EXE	cmd.exe
PID 460 wrote to memory of 1240	460	5.EXE	cmd.exe
PID 460 wrote to memory of 1240	460	5.EXE	cmd.exe
PID 460 wrote to memory of 1240	460	5.EXE	cmd.exe
PID 460 wrote to memory of 1240	460	5.EXE	cmd.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 460 wrote to memory of 652	460	5.EXE	notepad.exe
PID 1488 wrote to memory of 944	1488	cmd.exe	attrib.exe
PID 1488 wrote to memory of 944	1488	cmd.exe	attrib.exe
PID 1488 wrote to memory of 944	1488	cmd.exe	attrib.exe
PID 1488 wrote to memory of 944	1488	cmd.exe	attrib.exe
PID 1240 wrote to memory of 1576	1240	cmd.exe	attrib.exe
PID 1240 wrote to memory of 1576	1240	cmd.exe	attrib.exe
PID 1240 wrote to memory of 1576	1240	cmd.exe	attrib.exe
PID 1240 wrote to memory of 1576	1240	cmd.exe	attrib.exe
PID 460 wrote to memory of 1688	460	5.EXE	msdcsc.exe
PID 460 wrote to memory of 1688	460	5.EXE	msdcsc.exe
PID 460 wrote to memory of 1688	460	5.EXE	msdcsc.exe
PID 460 wrote to memory of 1688	460	5.EXE	msdcsc.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe
PID 1688 wrote to memory of 2036	1688	msdcsc.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

944 attrib.exe
1576 attrib.exe

pid	process
944	attrib.exe
1576	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe
"C:\Users\Admin\AppData\Local\Temp\b0dc3dbef3c1ecec8099f9531b9c0b4b913dbc244bfb0a6c399b40c66c81ccc0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828

C:\Users\Admin\AppData\Local\Temp\5.EXE
"C:\Users\Admin\AppData\Local\Temp\5.EXE"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\5.EXE" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\5.EXE" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1576

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:652

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MSDCSC\msdcsc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MSDCSC\msdcsc.exe"
3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:2036

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.JPG
Filesize
120KB

MD5
faf2c7f2c5975833768d4b4680976db0

SHA1
dfc1ec8437181964ff32079c28356d4cf1add8bb

SHA256
02cb07e408b88004343366654600fd01c0fa05bc8a09ce7acfd07b4fc8bf9a02

SHA512
c81a89318676b3aa139df1da8894ce3ed15e9fc011e7f08ed2a6a776b0835318b90f5d02f40a750a3bf7d6c36468bf1f360ad94d52925f92d56b8eaa370e5688

Download Submit
C:\Users\Admin\AppData\Local\Temp\5.EXE
Filesize
629KB

MD5
c4ce3a50c3a1cee27ff75153d047a547

SHA1
9d2117b1004e3dc45d421b8fd670168c77d8f834

SHA256
ef1f09a0fac40e5153c090639f161e122c77eab49ef74041fc0f04c66fbeba05

SHA512
0f923ad200f019bf9ddb966723cf2ff95df1243a879729139b6060a733d7ee1c40eef9f0627a2ab5e96b664d656ea56b9a276ac104162be7b41d5efef8e8a09c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5.EXE
Filesize
629KB

MD5
c4ce3a50c3a1cee27ff75153d047a547

SHA1
9d2117b1004e3dc45d421b8fd670168c77d8f834

SHA256
ef1f09a0fac40e5153c090639f161e122c77eab49ef74041fc0f04c66fbeba05

SHA512
0f923ad200f019bf9ddb966723cf2ff95df1243a879729139b6060a733d7ee1c40eef9f0627a2ab5e96b664d656ea56b9a276ac104162be7b41d5efef8e8a09c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MSDCSC\msdcsc.exe
Filesize
629KB

MD5
c4ce3a50c3a1cee27ff75153d047a547

SHA1
9d2117b1004e3dc45d421b8fd670168c77d8f834

SHA256
ef1f09a0fac40e5153c090639f161e122c77eab49ef74041fc0f04c66fbeba05

SHA512
0f923ad200f019bf9ddb966723cf2ff95df1243a879729139b6060a733d7ee1c40eef9f0627a2ab5e96b664d656ea56b9a276ac104162be7b41d5efef8e8a09c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MSDCSC\msdcsc.exe
Filesize
629KB

MD5
c4ce3a50c3a1cee27ff75153d047a547

SHA1
9d2117b1004e3dc45d421b8fd670168c77d8f834

SHA256
ef1f09a0fac40e5153c090639f161e122c77eab49ef74041fc0f04c66fbeba05

SHA512
0f923ad200f019bf9ddb966723cf2ff95df1243a879729139b6060a733d7ee1c40eef9f0627a2ab5e96b664d656ea56b9a276ac104162be7b41d5efef8e8a09c

Download Submit
\Users\Admin\AppData\Local\Temp\5.EXE
Filesize
629KB

MD5
c4ce3a50c3a1cee27ff75153d047a547

SHA1
9d2117b1004e3dc45d421b8fd670168c77d8f834

SHA256
ef1f09a0fac40e5153c090639f161e122c77eab49ef74041fc0f04c66fbeba05

SHA512
0f923ad200f019bf9ddb966723cf2ff95df1243a879729139b6060a733d7ee1c40eef9f0627a2ab5e96b664d656ea56b9a276ac104162be7b41d5efef8e8a09c

Download Submit
\Users\Admin\AppData\Local\Temp\5.EXE
Filesize
629KB

MD5
c4ce3a50c3a1cee27ff75153d047a547

SHA1
9d2117b1004e3dc45d421b8fd670168c77d8f834

SHA256
ef1f09a0fac40e5153c090639f161e122c77eab49ef74041fc0f04c66fbeba05

SHA512
0f923ad200f019bf9ddb966723cf2ff95df1243a879729139b6060a733d7ee1c40eef9f0627a2ab5e96b664d656ea56b9a276ac104162be7b41d5efef8e8a09c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MSDCSC\msdcsc.exe
Filesize
629KB

MD5
c4ce3a50c3a1cee27ff75153d047a547

SHA1
9d2117b1004e3dc45d421b8fd670168c77d8f834

SHA256
ef1f09a0fac40e5153c090639f161e122c77eab49ef74041fc0f04c66fbeba05

SHA512
0f923ad200f019bf9ddb966723cf2ff95df1243a879729139b6060a733d7ee1c40eef9f0627a2ab5e96b664d656ea56b9a276ac104162be7b41d5efef8e8a09c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MSDCSC\msdcsc.exe
Filesize
629KB

MD5
c4ce3a50c3a1cee27ff75153d047a547

SHA1
9d2117b1004e3dc45d421b8fd670168c77d8f834

SHA256
ef1f09a0fac40e5153c090639f161e122c77eab49ef74041fc0f04c66fbeba05

SHA512
0f923ad200f019bf9ddb966723cf2ff95df1243a879729139b6060a733d7ee1c40eef9f0627a2ab5e96b664d656ea56b9a276ac104162be7b41d5efef8e8a09c

Download Submit
memory/460-82-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/460-79-0x0000000005070000-0x00000000051C1000-memory.dmp

Filesize
1.3MB

Download
memory/460-63-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/460-62-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/460-58-0x0000000000000000-mapping.dmp

Download
memory/460-78-0x0000000005070000-0x00000000051C1000-memory.dmp

Filesize
1.3MB

Download
memory/652-66-0x0000000000000000-mapping.dmp

Download
memory/828-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/944-68-0x0000000000000000-mapping.dmp

Download
memory/1240-65-0x0000000000000000-mapping.dmp

Download
memory/1488-64-0x0000000000000000-mapping.dmp

Download
memory/1576-69-0x0000000000000000-mapping.dmp

Download
memory/1688-80-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/1688-72-0x0000000000000000-mapping.dmp

Download
memory/1688-83-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/1688-84-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2036-76-0x0000000000000000-mapping.dmp

Download