Malware Analysis Report

2025-06-16 06:44

Sample ID 240120-wrpbesebgm
Target 6b18a6b20832fb7929ccb4b3043f3218
SHA256 70635ba75fdb495bb4c0209f26176f0c0d40fd294c8b39898f18742f2e55ce20
Tags
darkcomet guest16 bootkit persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

70635ba75fdb495bb4c0209f26176f0c0d40fd294c8b39898f18742f2e55ce20

Threat Level: Known bad

The file 6b18a6b20832fb7929ccb4b3043f3218 was found to be: Known bad.

Malicious Activity Summary

darkcomet guest16 bootkit persistence rat trojan

Darkcomet

Modifies WinLogon for persistence

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Writes to the Master Boot Record (MBR)

Program crash

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-20 18:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-20 18:09

Reported

2024-01-20 18:12

Platform

win10v2004-20231215-en

Max time kernel

147s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
N/A N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 33 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 34 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 36 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4824 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 4072 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 4072 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 4072 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2740 wrote to memory of 3604 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 3604 wrote to memory of 3340 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3604 wrote to memory of 3340 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3604 wrote to memory of 3340 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3604 wrote to memory of 3340 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3604 wrote to memory of 3340 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3340 wrote to memory of 4648 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3340 wrote to memory of 4648 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3340 wrote to memory of 4648 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 3340 wrote to memory of 4648 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe

"C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"

C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe

"C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4648 -ip 4648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 84

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 192.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

memory/4072-2-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/4072-3-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/4072-4-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/4072-5-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/4072-6-0x0000000000750000-0x0000000000751000-memory.dmp

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 6b18a6b20832fb7929ccb4b3043f3218
SHA1 6f35aca55396af3e9f8e6939c4ee1bfb3f5bc69a
SHA256 70635ba75fdb495bb4c0209f26176f0c0d40fd294c8b39898f18742f2e55ce20
SHA512 f69815bc4bead7481be0ecaa43eb53b32c26a5502e40f4b3f68789534cf501246528a35e86bf3b092aed4864691192527414c7c949327c7610e1659377b230f9

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 83ca740e49c563d0601ac4814fbaf290
SHA1 52078490097e9507c60531b081231b89fcc10a27
SHA256 c1634b036cc7b82c68246af1fb32fbca23d364a05763a1d70bfbeb2a1b8c74bf
SHA512 33817687be440fb581d3bbb411ee56e531e7fd5c13aca582a0814ed896b8ca2bd0e10be7757fe686c7501ced58e7d121dbf9d5588667926e6affcd1cc91a63d9

memory/4072-19-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/3604-27-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/3604-28-0x0000000000810000-0x0000000000811000-memory.dmp

memory/3604-26-0x0000000000400000-0x00000000004F2000-memory.dmp

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 889d5824f56c3e078758ef4e53f31727
SHA1 e77aacc4bc9edde803f92a70ea50f9fa4975cf35
SHA256 30fb698b784ebb140d2d21b137d762638a58d8ceef1942a22923ca7fb1b53de3
SHA512 d656a683b0051989c958de8ea3c689e080612a78a36da3d7ba7154fcc82977fc1136d5e1b54208336ee9ecfcf36a7e61edbc19b0ffac0d6a667679c5a613e5a1

memory/3340-29-0x0000000000400000-0x00000000004F1000-memory.dmp

memory/3604-30-0x0000000000400000-0x00000000004F2000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-20 18:09

Reported

2024-01-20 18:12

Platform

win7-20231215-en

Max time kernel

131s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
N/A N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 33 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 34 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 2612 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
PID 1940 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 1940 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 1940 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 1940 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2748 wrote to memory of 2536 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
PID 2536 wrote to memory of 2528 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2536 wrote to memory of 2528 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2536 wrote to memory of 2528 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2536 wrote to memory of 2528 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2536 wrote to memory of 2528 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2536 wrote to memory of 2528 N/A C:\Users\Admin\Documents\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2560 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe

"C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"

C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe

"C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

Network

Country Destination Domain Proto
CH 84.72.27.213:1604 tcp
CH 84.72.27.213:1604 tcp
CH 84.72.27.213:1604 tcp
CH 84.72.27.213:1604 tcp
CH 84.72.27.213:1604 tcp
CH 84.72.27.213:1604 tcp
CH 84.72.27.213:1604 tcp

Files

memory/1940-2-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-4-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-6-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-8-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-10-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-12-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-14-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-16-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1940-20-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-21-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-22-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-23-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-24-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/1940-25-0x0000000000240000-0x0000000000241000-memory.dmp

\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 c9a40619dfdc1dada43c412323a32069
SHA1 667962426ebd67c057ad286f91e8f91b9c20e3bf
SHA256 da8b4dac71272c87c9340886ca40a70e24fd566d4ac7b3a8b3072d7789af9f35
SHA512 01ee538fc6cb872d1e4c0f65e53cb38cae975236003e1dae86641950ddab15e548ae0468527d66b5f8ed8534020cadb1c0fb8e6fdccbc456bd8c72cb025a3bf9

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 6b18a6b20832fb7929ccb4b3043f3218
SHA1 6f35aca55396af3e9f8e6939c4ee1bfb3f5bc69a
SHA256 70635ba75fdb495bb4c0209f26176f0c0d40fd294c8b39898f18742f2e55ce20
SHA512 f69815bc4bead7481be0ecaa43eb53b32c26a5502e40f4b3f68789534cf501246528a35e86bf3b092aed4864691192527414c7c949327c7610e1659377b230f9

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 7617c14e04407e82bbec55f07f6e3f55
SHA1 c9704a54b9077790394868c0b04f0e34ae3805ef
SHA256 c259d6579356f15594eaf963c5e620ae15f16ab84a3715d66390f94997f4f68c
SHA512 5272bf36b1f43c0a03c60e7d23afe2b15ba2a5f927260f25db46b22353d1c2445b4e4bf82fa2ae83b1ee2d17256f9be42f73124a69897e5ea414ee51236ad3cb

memory/1940-36-0x0000000000400000-0x00000000004F2000-memory.dmp

\Users\Admin\Documents\MSDCSC\msdcsc.exe

MD5 fc65b192df46c0032665308e99e38a8e
SHA1 08ea4b9c54456f97b2502e615dc84f0e9d6c5e98
SHA256 71e059fa78fa9f26226e1714295507cf4282dc73899a36a559fe65e5365c32a7
SHA512 c76a76acdba663b5859a5a4af70e400a1676cd87c57a19d9c80a3817b3927f88c4322bd96ff17783caff7d1cbea49ac9de274beb361b4a1943bf34d764227afc

memory/2536-63-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/2536-64-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/2536-68-0x0000000000400000-0x00000000004F2000-memory.dmp

memory/2528-67-0x0000000000400000-0x00000000004F1000-memory.dmp

memory/2536-66-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2536-65-0x0000000000400000-0x00000000004F2000-memory.dmp