Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 16:55
Static task
static1
Behavioral task
behavioral1
Sample
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe
Resource
win7-20220812-en
General
-
Target
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe
-
Size
2.5MB
-
MD5
b85bd40c70b5913df16cac41feae9949
-
SHA1
88139dbe95928614ab375ef0e3257a925dff0bb7
-
SHA256
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
-
SHA512
4c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
SSDEEP
49152:7JZoQrbTFZY1iaJag33A46NOBLtCaW/sXdkWQe9D+nwOWYcu2I7RTp/PwWUlLmY6:7trbTA19as3l8OBL+I7D+nwcP3tY6
Malware Config
Extracted
darkcomet
Victime
shytoos.ddns.net:1604
DC_MUTEX-Z8X4H3R
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
JJ52hfcLdTnD
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe -
Executes dropped EXE 3 IoCs
Processes:
bnd.exemsdcsc.exebnd.exepid process 1692 bnd.exe 304 msdcsc.exe 1092 bnd.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 384 attrib.exe 532 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1780 notepad.exe -
Loads dropped DLL 16 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exemsdcsc.exeWerFault.exepid process 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 304 msdcsc.exe 304 msdcsc.exe 304 msdcsc.exe 304 msdcsc.exe 304 msdcsc.exe 836 WerFault.exe 836 WerFault.exe 836 WerFault.exe 836 WerFault.exe 836 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe -
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe \Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe \Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe \Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe \Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe \Users\Admin\Documents\MSDCSC\msdcsc.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exedescription pid process target process PID 1340 set thread context of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 836 304 WerFault.exe msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exedescription pid process Token: SeIncreaseQuotaPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeSecurityPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeTakeOwnershipPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeLoadDriverPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeSystemProfilePrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeSystemtimePrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeProfSingleProcessPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeIncBasePriorityPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeCreatePagefilePrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeBackupPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeRestorePrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeShutdownPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeDebugPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeSystemEnvironmentPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeChangeNotifyPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeRemoteShutdownPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeUndockPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeManageVolumePrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeImpersonatePrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: SeCreateGlobalPrivilege 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: 33 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: 34 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe Token: 35 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1340 wrote to memory of 1692 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe bnd.exe PID 1340 wrote to memory of 1692 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe bnd.exe PID 1340 wrote to memory of 1692 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe bnd.exe PID 1340 wrote to memory of 1692 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe bnd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1340 wrote to memory of 1320 1340 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe PID 1320 wrote to memory of 792 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1320 wrote to memory of 792 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1320 wrote to memory of 792 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1320 wrote to memory of 792 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1320 wrote to memory of 752 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1320 wrote to memory of 752 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1320 wrote to memory of 752 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1320 wrote to memory of 752 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe cmd.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 792 wrote to memory of 384 792 cmd.exe attrib.exe PID 792 wrote to memory of 384 792 cmd.exe attrib.exe PID 792 wrote to memory of 384 792 cmd.exe attrib.exe PID 792 wrote to memory of 384 792 cmd.exe attrib.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 1320 wrote to memory of 1780 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe notepad.exe PID 752 wrote to memory of 532 752 cmd.exe attrib.exe PID 752 wrote to memory of 532 752 cmd.exe attrib.exe PID 752 wrote to memory of 532 752 cmd.exe attrib.exe PID 752 wrote to memory of 532 752 cmd.exe attrib.exe PID 1320 wrote to memory of 304 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe msdcsc.exe PID 1320 wrote to memory of 304 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe msdcsc.exe PID 1320 wrote to memory of 304 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe msdcsc.exe PID 1320 wrote to memory of 304 1320 53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe msdcsc.exe PID 304 wrote to memory of 1092 304 msdcsc.exe bnd.exe PID 304 wrote to memory of 1092 304 msdcsc.exe bnd.exe PID 304 wrote to memory of 1092 304 msdcsc.exe bnd.exe PID 304 wrote to memory of 1092 304 msdcsc.exe bnd.exe PID 304 wrote to memory of 836 304 msdcsc.exe WerFault.exe PID 304 wrote to memory of 836 304 msdcsc.exe WerFault.exe PID 304 wrote to memory of 836 304 msdcsc.exe WerFault.exe PID 304 wrote to memory of 836 304 msdcsc.exe WerFault.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 532 attrib.exe 384 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe"C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bnd.exe"C:\Users\Admin\AppData\Local\Temp\bnd.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe"C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\53378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bnd.exe"C:\Users\Admin\AppData\Local\Temp\bnd.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 3764⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
C:\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
C:\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
C:\Users\Admin\AppData\Local\Temp\sse.pngFilesize
659KB
MD5506319032d04373381f748aa2af026f8
SHA1a0822f9afd1d1feeb3240d0e7414ec3f76d4c704
SHA2568834285f04a20ce9bd17e1e6c69250c7b14ad1d217fa77f510a11084396a6077
SHA5122d89e307151241f325bd2677ece48072e679be93945cb31db194fae64a31e25ff11e32c698d87dc68b5885f0dc8ae17fde09312ffef0252364721eb50f705010
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\AppData\Local\Temp\bnd.exeFilesize
199KB
MD559cb3eb306b317261d85b4d0bd5eb432
SHA131c11cf8b4e8c65287e7a246ec691c9d044a22ca
SHA2569e5b15cce11d51b0157c84a720932e30fc5e1dd1b76ca86dd65fe2fa9028c19d
SHA512ed5b1acb320f395ac966dd456e8ff4668413283bb1c6dc4d7086c1f8cc1e244ffcbd1f356987e9b1d9c6d9f1123ffdba80a226f2ff7351dbbea714bf9a59ea36
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.5MB
MD5b85bd40c70b5913df16cac41feae9949
SHA188139dbe95928614ab375ef0e3257a925dff0bb7
SHA25653378d1cdf29ba3d6281f32d4a787402c750cb60b207565a74f426922a451ccd
SHA5124c57449a1afe32959c5b9760ad065392e4e0b29f3f2323202b4649393a764b71dff03af9aa02a7154f0c24e1855b97eb1b32994aa2b692f0844bd29a1d63535d
-
memory/304-92-0x0000000000000000-mapping.dmp
-
memory/384-88-0x0000000000000000-mapping.dmp
-
memory/532-90-0x0000000000000000-mapping.dmp
-
memory/752-85-0x0000000000000000-mapping.dmp
-
memory/792-84-0x0000000000000000-mapping.dmp
-
memory/836-107-0x0000000000000000-mapping.dmp
-
memory/1092-112-0x0000000004AC5000-0x0000000004AD6000-memory.dmpFilesize
68KB
-
memory/1092-103-0x0000000000000000-mapping.dmp
-
memory/1320-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-76-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-96-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-82-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-80-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-79-0x000000000048F888-mapping.dmp
-
memory/1320-78-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-87-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-73-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-74-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-71-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1340-54-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/1692-97-0x0000000004D95000-0x0000000004DA6000-memory.dmpFilesize
68KB
-
memory/1692-63-0x0000000000110000-0x000000000014A000-memory.dmpFilesize
232KB
-
memory/1692-60-0x0000000000000000-mapping.dmp
-
memory/1780-86-0x0000000000000000-mapping.dmp