Resubmissions

05-02-2023 21:38

230205-1hcy9aec91 7

05-02-2023 21:35

230205-1fp6ssec9v 7

Analysis

  • max time kernel
    81s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-20221111-es
  • resource tags

    arch:x64arch:x86image:win7-20221111-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    05-02-2023 21:35

General

  • Target

    DCSB_4.0.0.9.exe

  • Size

    755KB

  • MD5

    08249b3f3d1623717d28e072094ccad9

  • SHA1

    58e0e645e96b2d7d7f2b5f78dfe51daf035510cc

  • SHA256

    d39db773d0d16d73e170e4f7a0c5fe2ebe4c93ab605a36f52ff3fb2d0f4b7104

  • SHA512

    9a4f3d043e2e859c0b170a64a456bd02cab9a7bb3c0dce605835f053a4289a148d454fcf611626fd3cf710502460bf6b4d5fef76db7a67d821173ba8fa3f37dd

  • SSDEEP

    12288:HU/8H3bqNOS5/6kfpezcuCHQAS4u5DwysyvzuuPr6QiU6VmWjyFeS:H7H3bqT/6UpLHQASv5DwyNzD5SV/m

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 61 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DCSB_4.0.0.9.exe
    "C:\Users\Admin\AppData\Local\Temp\DCSB_4.0.0.9.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:980
    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.exe
      "C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1060
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x1f0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1216
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1104

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Business.dll

      Filesize

      18KB

      MD5

      e2b07011a7086d487a8839bb324422f2

      SHA1

      6c117ce5de35dcd6ab745e75b2a110d2304dfe97

      SHA256

      e823a85ae706240167a75bdae6d025b388fad7e1f835cfdb330f01cddab058ce

      SHA512

      e2cd594b2f82d14bbd2a95f2d31830fd142f483ed40d3c71546aa371766a54620d9a5465a85ad2c008b4929bdee3b44e5ef54336e17cafcb8c739cf993b2b465

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Converters.dll

      Filesize

      7KB

      MD5

      2d293ff6036f5d766598aa9e9c8527a5

      SHA1

      317c41a4030f1c9fff49cd6a6ee6de6081d39887

      SHA256

      251b07d2fe46f625352f2298df57642e859468ac635b420ca42f68c509d50745

      SHA512

      437d1fc7f89bf7fd745810e72317c809c89023908770d420753dfba4d5a55031bd032b427d049666f56d532de8f62863453aab9ae5ef271d576bfd0a6d115375

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Icons.dll

      Filesize

      9KB

      MD5

      6310704d43d121c3acbd5281f4716be0

      SHA1

      0efce3a05af5d5821c6f3b32ff4b088b4966237d

      SHA256

      445337c0768df9d2eb5408eedec739c66e67cffa261775f4478cffabea832d35

      SHA512

      8ca586e99088e6ac6093ed5624fe9b6ed39b19eb8660c0ebd107d0d55a22143a037917cf4bc410933e440a656fca19c3a001229f1584a39a2f09a4342ac98e15

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Interactivity.dll

      Filesize

      9KB

      MD5

      b04e8e7ce5d3b67afa187f8640091671

      SHA1

      3dc1ca3b7659a5810f1d05069617cab6afe9a8b3

      SHA256

      facbfa255050a66a2c7cf595cf5d2291cd2b3bf0f4bda7f4610f269adece5219

      SHA512

      e5a19b365ea94a14aaeb03056905dd04f045a8cbd13a490f020e9f34d02c600549862a0c73d4945a09a52a80f6eade00a154f1f985ffb66615a73d5537aeac3b

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Models.dll

      Filesize

      19KB

      MD5

      4789a95ae263346e177d290cabecdfed

      SHA1

      fe4c13ea38f3eb136d4d25757a8e60f2777cf850

      SHA256

      2f932429a33881c4bcf201e5708871434e8378b8405f870683a079e53390342d

      SHA512

      d6d0b5de9075013f785700300c463d0554d9c96c8e1994bdf4586919a5238c581bf603308938a27dd67ed877d7241444cab02bdd6f68c9b5a7eecd073831c45d

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Utils.dll

      Filesize

      8KB

      MD5

      afc7148a94b0addff7258579ccbc4268

      SHA1

      b96c9e88911c34e83982d66aa85ec9d6dc59b38b

      SHA256

      f8ead606bacb4fbf4c777a09cf50275210020ee4102a6e1c191521474a2e09c0

      SHA512

      0884b957323414ea4d46c442a600bde425e1a352360b41f4efcb2c49e04c08e03699ba9f3a3c125c873b7e86e833bfffaf0bf9a28d1550efbdc83f67ce080acf

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.ViewModels.dll

      Filesize

      21KB

      MD5

      8e1062c7174bf620b011976c24f1c6e3

      SHA1

      ab17c4cde8110ba7f6d4a8e0cf07dcb56426f4f5

      SHA256

      9420c5964d1c20ebaa603a9a1658ac11f007d5b741b1af98ae7010c3c5687393

      SHA512

      a4a28efeab45e3de7ab9b51ba689f230222c345e659c9ba47989744b4c1b4f3df8141d2ffac74eaee50bd1a5caa1604fd5bcf4f32a6ca9395a9d29ab048c0044

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Views.dll

      Filesize

      44KB

      MD5

      707f63e8a4bc8736b0c19418726f61bd

      SHA1

      8057558b28245ab82e1f1cddfc35443f467f0b55

      SHA256

      f2c43f2acb1cae618be2d18514cea190b309098c2a10da4fb1f8f0bc6efe4287

      SHA512

      400af90f8aa075afb90994b7bbd23e64fbce6a8f9deac4be62e1be98d58cfdb9d4ed073209dbf16f5ea323920e3d1361f6e7b691dd724565d14ca416f6bd787c

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.exe

      Filesize

      27KB

      MD5

      2c3fe3d9fc757e2bef7a9a6867eb0431

      SHA1

      513b17e636e824e08325419dbd0a14d368ec1c02

      SHA256

      ed036b3773eba9bfda7c9c7ce55f5495fdc3caf57f8ce72a56820edc98ff39ea

      SHA512

      b02783ffbdbdfbc5d51e68568543b8c533146dcffee234a8feff0d7d2425ca3ed45fea41e8b39afc0f93655e657bf77e1659c400b9cb3229119e14855520937f

    • C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.exe

      Filesize

      27KB

      MD5

      2c3fe3d9fc757e2bef7a9a6867eb0431

      SHA1

      513b17e636e824e08325419dbd0a14d368ec1c02

      SHA256

      ed036b3773eba9bfda7c9c7ce55f5495fdc3caf57f8ce72a56820edc98ff39ea

      SHA512

      b02783ffbdbdfbc5d51e68568543b8c533146dcffee234a8feff0d7d2425ca3ed45fea41e8b39afc0f93655e657bf77e1659c400b9cb3229119e14855520937f

    • C:\Program Files (x86)\Deathcounter and Soundboard\GalaSoft.MvvmLight.Platform.dll

      Filesize

      13KB

      MD5

      5b958b4229538ac23099ce9ed6f37de4

      SHA1

      32cd46e39c4f6334d28788d5e3afaa19d4fd1041

      SHA256

      2a1114c99533aae7442b298336247350b55caa193c06454ea606d6a394656573

      SHA512

      87b6a509d1cb262e6ba198819ffec3b8e03e4672b031ff918fe406307f750192a73c73dcd8140d8be5dcc8286a79e779fad59189ae7ac759cec6223e55b9b899

    • C:\Program Files (x86)\Deathcounter and Soundboard\GalaSoft.MvvmLight.dll

      Filesize

      29KB

      MD5

      af04687248da9e95a7ff65ab538d0bcf

      SHA1

      7511184300e2b6f70bc92333392386a812b2dabf

      SHA256

      b097fca120a9e76fa870d82662bdd233adbf08fc34a3c509f31cc5ced0ac1ecf

      SHA512

      a5eab337f6386de5fb2cc809730bac7d17cdfb309afea32e65e9d8c457f97ac3e3f03cebd48535cf253e28f3aa600f234631c2060ec59acb917cb5f135f4b67a

    • C:\Program Files (x86)\Deathcounter and Soundboard\System.Windows.Interactivity.dll

      Filesize

      54KB

      MD5

      580244bc805220253a87196913eb3e5e

      SHA1

      ce6c4c18cf638f980905b9cb6710ee1fa73bb397

      SHA256

      93fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf

      SHA512

      2666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Business.dll

      Filesize

      18KB

      MD5

      e2b07011a7086d487a8839bb324422f2

      SHA1

      6c117ce5de35dcd6ab745e75b2a110d2304dfe97

      SHA256

      e823a85ae706240167a75bdae6d025b388fad7e1f835cfdb330f01cddab058ce

      SHA512

      e2cd594b2f82d14bbd2a95f2d31830fd142f483ed40d3c71546aa371766a54620d9a5465a85ad2c008b4929bdee3b44e5ef54336e17cafcb8c739cf993b2b465

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Business.dll

      Filesize

      18KB

      MD5

      e2b07011a7086d487a8839bb324422f2

      SHA1

      6c117ce5de35dcd6ab745e75b2a110d2304dfe97

      SHA256

      e823a85ae706240167a75bdae6d025b388fad7e1f835cfdb330f01cddab058ce

      SHA512

      e2cd594b2f82d14bbd2a95f2d31830fd142f483ed40d3c71546aa371766a54620d9a5465a85ad2c008b4929bdee3b44e5ef54336e17cafcb8c739cf993b2b465

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Converters.dll

      Filesize

      7KB

      MD5

      2d293ff6036f5d766598aa9e9c8527a5

      SHA1

      317c41a4030f1c9fff49cd6a6ee6de6081d39887

      SHA256

      251b07d2fe46f625352f2298df57642e859468ac635b420ca42f68c509d50745

      SHA512

      437d1fc7f89bf7fd745810e72317c809c89023908770d420753dfba4d5a55031bd032b427d049666f56d532de8f62863453aab9ae5ef271d576bfd0a6d115375

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Converters.dll

      Filesize

      7KB

      MD5

      2d293ff6036f5d766598aa9e9c8527a5

      SHA1

      317c41a4030f1c9fff49cd6a6ee6de6081d39887

      SHA256

      251b07d2fe46f625352f2298df57642e859468ac635b420ca42f68c509d50745

      SHA512

      437d1fc7f89bf7fd745810e72317c809c89023908770d420753dfba4d5a55031bd032b427d049666f56d532de8f62863453aab9ae5ef271d576bfd0a6d115375

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Icons.dll

      Filesize

      9KB

      MD5

      6310704d43d121c3acbd5281f4716be0

      SHA1

      0efce3a05af5d5821c6f3b32ff4b088b4966237d

      SHA256

      445337c0768df9d2eb5408eedec739c66e67cffa261775f4478cffabea832d35

      SHA512

      8ca586e99088e6ac6093ed5624fe9b6ed39b19eb8660c0ebd107d0d55a22143a037917cf4bc410933e440a656fca19c3a001229f1584a39a2f09a4342ac98e15

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Icons.dll

      Filesize

      9KB

      MD5

      6310704d43d121c3acbd5281f4716be0

      SHA1

      0efce3a05af5d5821c6f3b32ff4b088b4966237d

      SHA256

      445337c0768df9d2eb5408eedec739c66e67cffa261775f4478cffabea832d35

      SHA512

      8ca586e99088e6ac6093ed5624fe9b6ed39b19eb8660c0ebd107d0d55a22143a037917cf4bc410933e440a656fca19c3a001229f1584a39a2f09a4342ac98e15

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Interactivity.dll

      Filesize

      9KB

      MD5

      b04e8e7ce5d3b67afa187f8640091671

      SHA1

      3dc1ca3b7659a5810f1d05069617cab6afe9a8b3

      SHA256

      facbfa255050a66a2c7cf595cf5d2291cd2b3bf0f4bda7f4610f269adece5219

      SHA512

      e5a19b365ea94a14aaeb03056905dd04f045a8cbd13a490f020e9f34d02c600549862a0c73d4945a09a52a80f6eade00a154f1f985ffb66615a73d5537aeac3b

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Interactivity.dll

      Filesize

      9KB

      MD5

      b04e8e7ce5d3b67afa187f8640091671

      SHA1

      3dc1ca3b7659a5810f1d05069617cab6afe9a8b3

      SHA256

      facbfa255050a66a2c7cf595cf5d2291cd2b3bf0f4bda7f4610f269adece5219

      SHA512

      e5a19b365ea94a14aaeb03056905dd04f045a8cbd13a490f020e9f34d02c600549862a0c73d4945a09a52a80f6eade00a154f1f985ffb66615a73d5537aeac3b

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Models.dll

      Filesize

      19KB

      MD5

      4789a95ae263346e177d290cabecdfed

      SHA1

      fe4c13ea38f3eb136d4d25757a8e60f2777cf850

      SHA256

      2f932429a33881c4bcf201e5708871434e8378b8405f870683a079e53390342d

      SHA512

      d6d0b5de9075013f785700300c463d0554d9c96c8e1994bdf4586919a5238c581bf603308938a27dd67ed877d7241444cab02bdd6f68c9b5a7eecd073831c45d

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Models.dll

      Filesize

      19KB

      MD5

      4789a95ae263346e177d290cabecdfed

      SHA1

      fe4c13ea38f3eb136d4d25757a8e60f2777cf850

      SHA256

      2f932429a33881c4bcf201e5708871434e8378b8405f870683a079e53390342d

      SHA512

      d6d0b5de9075013f785700300c463d0554d9c96c8e1994bdf4586919a5238c581bf603308938a27dd67ed877d7241444cab02bdd6f68c9b5a7eecd073831c45d

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Utils.dll

      Filesize

      8KB

      MD5

      afc7148a94b0addff7258579ccbc4268

      SHA1

      b96c9e88911c34e83982d66aa85ec9d6dc59b38b

      SHA256

      f8ead606bacb4fbf4c777a09cf50275210020ee4102a6e1c191521474a2e09c0

      SHA512

      0884b957323414ea4d46c442a600bde425e1a352360b41f4efcb2c49e04c08e03699ba9f3a3c125c873b7e86e833bfffaf0bf9a28d1550efbdc83f67ce080acf

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Utils.dll

      Filesize

      8KB

      MD5

      afc7148a94b0addff7258579ccbc4268

      SHA1

      b96c9e88911c34e83982d66aa85ec9d6dc59b38b

      SHA256

      f8ead606bacb4fbf4c777a09cf50275210020ee4102a6e1c191521474a2e09c0

      SHA512

      0884b957323414ea4d46c442a600bde425e1a352360b41f4efcb2c49e04c08e03699ba9f3a3c125c873b7e86e833bfffaf0bf9a28d1550efbdc83f67ce080acf

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.ViewModels.dll

      Filesize

      21KB

      MD5

      8e1062c7174bf620b011976c24f1c6e3

      SHA1

      ab17c4cde8110ba7f6d4a8e0cf07dcb56426f4f5

      SHA256

      9420c5964d1c20ebaa603a9a1658ac11f007d5b741b1af98ae7010c3c5687393

      SHA512

      a4a28efeab45e3de7ab9b51ba689f230222c345e659c9ba47989744b4c1b4f3df8141d2ffac74eaee50bd1a5caa1604fd5bcf4f32a6ca9395a9d29ab048c0044

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.ViewModels.dll

      Filesize

      21KB

      MD5

      8e1062c7174bf620b011976c24f1c6e3

      SHA1

      ab17c4cde8110ba7f6d4a8e0cf07dcb56426f4f5

      SHA256

      9420c5964d1c20ebaa603a9a1658ac11f007d5b741b1af98ae7010c3c5687393

      SHA512

      a4a28efeab45e3de7ab9b51ba689f230222c345e659c9ba47989744b4c1b4f3df8141d2ffac74eaee50bd1a5caa1604fd5bcf4f32a6ca9395a9d29ab048c0044

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Views.dll

      Filesize

      44KB

      MD5

      707f63e8a4bc8736b0c19418726f61bd

      SHA1

      8057558b28245ab82e1f1cddfc35443f467f0b55

      SHA256

      f2c43f2acb1cae618be2d18514cea190b309098c2a10da4fb1f8f0bc6efe4287

      SHA512

      400af90f8aa075afb90994b7bbd23e64fbce6a8f9deac4be62e1be98d58cfdb9d4ed073209dbf16f5ea323920e3d1361f6e7b691dd724565d14ca416f6bd787c

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.Views.dll

      Filesize

      44KB

      MD5

      707f63e8a4bc8736b0c19418726f61bd

      SHA1

      8057558b28245ab82e1f1cddfc35443f467f0b55

      SHA256

      f2c43f2acb1cae618be2d18514cea190b309098c2a10da4fb1f8f0bc6efe4287

      SHA512

      400af90f8aa075afb90994b7bbd23e64fbce6a8f9deac4be62e1be98d58cfdb9d4ed073209dbf16f5ea323920e3d1361f6e7b691dd724565d14ca416f6bd787c

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.exe

      Filesize

      27KB

      MD5

      2c3fe3d9fc757e2bef7a9a6867eb0431

      SHA1

      513b17e636e824e08325419dbd0a14d368ec1c02

      SHA256

      ed036b3773eba9bfda7c9c7ce55f5495fdc3caf57f8ce72a56820edc98ff39ea

      SHA512

      b02783ffbdbdfbc5d51e68568543b8c533146dcffee234a8feff0d7d2425ca3ed45fea41e8b39afc0f93655e657bf77e1659c400b9cb3229119e14855520937f

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.exe

      Filesize

      27KB

      MD5

      2c3fe3d9fc757e2bef7a9a6867eb0431

      SHA1

      513b17e636e824e08325419dbd0a14d368ec1c02

      SHA256

      ed036b3773eba9bfda7c9c7ce55f5495fdc3caf57f8ce72a56820edc98ff39ea

      SHA512

      b02783ffbdbdfbc5d51e68568543b8c533146dcffee234a8feff0d7d2425ca3ed45fea41e8b39afc0f93655e657bf77e1659c400b9cb3229119e14855520937f

    • \Program Files (x86)\Deathcounter and Soundboard\DCSB.exe

      Filesize

      27KB

      MD5

      2c3fe3d9fc757e2bef7a9a6867eb0431

      SHA1

      513b17e636e824e08325419dbd0a14d368ec1c02

      SHA256

      ed036b3773eba9bfda7c9c7ce55f5495fdc3caf57f8ce72a56820edc98ff39ea

      SHA512

      b02783ffbdbdfbc5d51e68568543b8c533146dcffee234a8feff0d7d2425ca3ed45fea41e8b39afc0f93655e657bf77e1659c400b9cb3229119e14855520937f

    • \Program Files (x86)\Deathcounter and Soundboard\GalaSoft.MvvmLight.Platform.dll

      Filesize

      13KB

      MD5

      5b958b4229538ac23099ce9ed6f37de4

      SHA1

      32cd46e39c4f6334d28788d5e3afaa19d4fd1041

      SHA256

      2a1114c99533aae7442b298336247350b55caa193c06454ea606d6a394656573

      SHA512

      87b6a509d1cb262e6ba198819ffec3b8e03e4672b031ff918fe406307f750192a73c73dcd8140d8be5dcc8286a79e779fad59189ae7ac759cec6223e55b9b899

    • \Program Files (x86)\Deathcounter and Soundboard\GalaSoft.MvvmLight.Platform.dll

      Filesize

      13KB

      MD5

      5b958b4229538ac23099ce9ed6f37de4

      SHA1

      32cd46e39c4f6334d28788d5e3afaa19d4fd1041

      SHA256

      2a1114c99533aae7442b298336247350b55caa193c06454ea606d6a394656573

      SHA512

      87b6a509d1cb262e6ba198819ffec3b8e03e4672b031ff918fe406307f750192a73c73dcd8140d8be5dcc8286a79e779fad59189ae7ac759cec6223e55b9b899

    • \Program Files (x86)\Deathcounter and Soundboard\GalaSoft.MvvmLight.dll

      Filesize

      29KB

      MD5

      af04687248da9e95a7ff65ab538d0bcf

      SHA1

      7511184300e2b6f70bc92333392386a812b2dabf

      SHA256

      b097fca120a9e76fa870d82662bdd233adbf08fc34a3c509f31cc5ced0ac1ecf

      SHA512

      a5eab337f6386de5fb2cc809730bac7d17cdfb309afea32e65e9d8c457f97ac3e3f03cebd48535cf253e28f3aa600f234631c2060ec59acb917cb5f135f4b67a

    • \Program Files (x86)\Deathcounter and Soundboard\GalaSoft.MvvmLight.dll

      Filesize

      29KB

      MD5

      af04687248da9e95a7ff65ab538d0bcf

      SHA1

      7511184300e2b6f70bc92333392386a812b2dabf

      SHA256

      b097fca120a9e76fa870d82662bdd233adbf08fc34a3c509f31cc5ced0ac1ecf

      SHA512

      a5eab337f6386de5fb2cc809730bac7d17cdfb309afea32e65e9d8c457f97ac3e3f03cebd48535cf253e28f3aa600f234631c2060ec59acb917cb5f135f4b67a

    • \Program Files (x86)\Deathcounter and Soundboard\System.Windows.Interactivity.dll

      Filesize

      54KB

      MD5

      580244bc805220253a87196913eb3e5e

      SHA1

      ce6c4c18cf638f980905b9cb6710ee1fa73bb397

      SHA256

      93fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf

      SHA512

      2666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0

    • \Program Files (x86)\Deathcounter and Soundboard\System.Windows.Interactivity.dll

      Filesize

      54KB

      MD5

      580244bc805220253a87196913eb3e5e

      SHA1

      ce6c4c18cf638f980905b9cb6710ee1fa73bb397

      SHA256

      93fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf

      SHA512

      2666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0

    • \Program Files (x86)\Deathcounter and Soundboard\uninstall.exe

      Filesize

      69KB

      MD5

      90900a4c8850cb765c00d1a8b0ba4ce2

      SHA1

      b032827090c826bc689da37eaba6b3d098a5e90f

      SHA256

      bb65474c574300f34e8b505ca8eafc7c1a3ea92cc2c6175686ee7a3f637ed45c

      SHA512

      429ae2847558b5f51e25c3f1179a2fcb7b598aba5af545ce9cdf6dd6bb993a28eb975d0565eb183aa9216810a39200fa6c5624a873914a5204f966a069ccdc82

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\InstallOptions.dll

      Filesize

      14KB

      MD5

      5d425526856cbdb7b14c75df417b6ef3

      SHA1

      46407f40cac772bca3804dc80fd489f87668a9e3

      SHA256

      aaacc7ef5cb2baf2338ac8e8479227e0a6336a6509119543680efa1dcdbae6a6

      SHA512

      b806bf9622040d120b407ae83d20ae935c9ff210332062f8fa3eccecba2a41bd041cf9523d500f9ce11b73076b97a884907cc06722531c2fe9b8d96ec16124fb

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • \Users\Admin\AppData\Local\Temp\nsy1DCF.tmp\System.dll

      Filesize

      11KB

      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

    • memory/980-54-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

      Filesize

      8KB

    • memory/1060-101-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

      Filesize

      40KB

    • memory/1060-124-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

      Filesize

      40KB

    • memory/1060-123-0x0000000000EF0000-0x0000000000EF8000-memory.dmp

      Filesize

      32KB

    • memory/1060-118-0x0000000000D40000-0x0000000000D52000-memory.dmp

      Filesize

      72KB

    • memory/1060-119-0x0000000000955000-0x0000000000966000-memory.dmp

      Filesize

      68KB

    • memory/1060-125-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

      Filesize

      40KB

    • memory/1060-114-0x0000000000CF0000-0x0000000000CF8000-memory.dmp

      Filesize

      32KB

    • memory/1060-110-0x0000000000B00000-0x0000000000B0A000-memory.dmp

      Filesize

      40KB

    • memory/1060-106-0x0000000000AF0000-0x0000000000B00000-memory.dmp

      Filesize

      64KB

    • memory/1060-129-0x0000000000F40000-0x0000000000F48000-memory.dmp

      Filesize

      32KB

    • memory/1060-133-0x0000000004360000-0x000000000436C000-memory.dmp

      Filesize

      48KB

    • memory/1060-137-0x0000000004370000-0x000000000437C000-memory.dmp

      Filesize

      48KB

    • memory/1060-102-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

      Filesize

      32KB

    • memory/1060-100-0x0000000000A60000-0x0000000000A6E000-memory.dmp

      Filesize

      56KB

    • memory/1060-96-0x0000000000A50000-0x0000000000A5C000-memory.dmp

      Filesize

      48KB

    • memory/1060-92-0x0000000000A40000-0x0000000000A48000-memory.dmp

      Filesize

      32KB

    • memory/1060-87-0x0000000000F50000-0x0000000000F5C000-memory.dmp

      Filesize

      48KB

    • memory/1060-84-0x0000000000000000-mapping.dmp

    • memory/1060-138-0x0000000004390000-0x0000000004398000-memory.dmp

      Filesize

      32KB

    • memory/1060-139-0x00000000043A0000-0x00000000043A8000-memory.dmp

      Filesize

      32KB

    • memory/1060-140-0x0000000004E30000-0x0000000004EAC000-memory.dmp

      Filesize

      496KB

    • memory/1060-141-0x0000000004F00000-0x0000000004F08000-memory.dmp

      Filesize

      32KB

    • memory/1060-142-0x00000000050D0000-0x00000000050D8000-memory.dmp

      Filesize

      32KB

    • memory/1060-143-0x0000000005C50000-0x0000000005D14000-memory.dmp

      Filesize

      784KB

    • memory/1060-144-0x0000000005340000-0x0000000005348000-memory.dmp

      Filesize

      32KB

    • memory/1060-145-0x0000000005460000-0x000000000546C000-memory.dmp

      Filesize

      48KB

    • memory/1060-146-0x0000000000955000-0x0000000000966000-memory.dmp

      Filesize

      68KB

    • memory/1060-147-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

      Filesize

      40KB

    • memory/1060-148-0x0000000000955000-0x0000000000966000-memory.dmp

      Filesize

      68KB

    • memory/1104-149-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmp

      Filesize

      8KB