Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
71s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2024, 19:07
Behavioral task
behavioral1
Sample
a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe
-
Size
660KB
-
MD5
a39e406a9096eafa928a424f806c7282
-
SHA1
1e5ab6834818e098b27c1c0ed616a8456ee40dcc
-
SHA256
e607408e4c002676eb8c7f1a61f5a2c1d2c52b262ca98f71e5218297ccc96bc1
-
SHA512
b373670d309f7787b7a64d0db7bacd8bfb4d9695a96c9cc10d190b78ea0c3947954a1dcd4be352eb193a3c377f3c51f34387833d16c0f3b79d4189611a4839b5
-
SSDEEP
12288:UXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UY:CnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JI
Malware Config
Extracted
darkcomet
ByGolge
haybensenin3.zapto.org:1604
DC_MUTEX-NXLR9FFS8Z5SQ8W8S5F5T5G5H5Y9Y8Y4H5G2A2S5DQ8W7Z92NNG2YZ1Q
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
MBzeYmsBiawB
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe -
Sets file to hidden 1 TTPs 64 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3172 attrib.exe 3020 attrib.exe 6948 attrib.exe 7468 attrib.exe 7792 attrib.exe 7996 attrib.exe 9876 attrib.exe 10824 attrib.exe 10160 attrib.exe 7580 attrib.exe 4112 attrib.exe 1400 attrib.exe 2332 attrib.exe 1980 attrib.exe 2836 attrib.exe 3764 attrib.exe 11564 attrib.exe 13236 attrib.exe 12532 attrib.exe 3940 attrib.exe 6148 attrib.exe 8828 attrib.exe 4400 attrib.exe 12024 attrib.exe 12480 attrib.exe 13068 attrib.exe 8048 attrib.exe 9724 attrib.exe 1704 attrib.exe 8220 attrib.exe 11864 attrib.exe 12776 attrib.exe 796 attrib.exe 5140 attrib.exe 7044 attrib.exe 7740 attrib.exe 10208 attrib.exe 4492 attrib.exe 14048 attrib.exe 8372 attrib.exe 3708 attrib.exe 8972 attrib.exe 8440 attrib.exe 9284 attrib.exe 10384 attrib.exe 10864 attrib.exe 8000 attrib.exe 5552 attrib.exe 11920 attrib.exe 14216 attrib.exe 1332 attrib.exe 5448 attrib.exe 6900 attrib.exe 10592 attrib.exe 13324 attrib.exe 7988 attrib.exe 8676 attrib.exe 3228 attrib.exe 7008 attrib.exe 12632 attrib.exe 7276 attrib.exe 13740 attrib.exe 8704 attrib.exe 9140 attrib.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation msdcsc.exe -
Deletes itself 1 IoCs
pid Process 4832 notepad.exe -
Executes dropped EXE 64 IoCs
pid Process 1520 msdcsc.exe 996 msdcsc.exe 2708 msdcsc.exe 5052 msdcsc.exe 1020 msdcsc.exe 5032 msdcsc.exe 1336 msdcsc.exe 1568 msdcsc.exe 4420 msdcsc.exe 220 msdcsc.exe 3056 msdcsc.exe 4612 msdcsc.exe 1172 msdcsc.exe 5032 msdcsc.exe 2640 msdcsc.exe 4548 msdcsc.exe 4924 msdcsc.exe 2680 msdcsc.exe 1440 msdcsc.exe 5160 msdcsc.exe 5316 msdcsc.exe 5468 msdcsc.exe 5620 msdcsc.exe 5768 msdcsc.exe 5916 msdcsc.exe 6116 msdcsc.exe 5200 msdcsc.exe 5608 msdcsc.exe 5904 msdcsc.exe 4444 msdcsc.exe 6116 msdcsc.exe 5468 msdcsc.exe 432 msdcsc.exe 5916 msdcsc.exe 6164 msdcsc.exe 6328 msdcsc.exe 6472 msdcsc.exe 6620 msdcsc.exe 6764 msdcsc.exe 6916 msdcsc.exe 7060 msdcsc.exe 2372 msdcsc.exe 6344 msdcsc.exe 6640 msdcsc.exe 6936 msdcsc.exe 6332 msdcsc.exe 6656 msdcsc.exe 5932 msdcsc.exe 7192 msdcsc.exe 7340 msdcsc.exe 7484 msdcsc.exe 7632 msdcsc.exe 7828 msdcsc.exe 8008 msdcsc.exe 8168 msdcsc.exe 7200 msdcsc.exe 7492 msdcsc.exe 7892 msdcsc.exe 8028 msdcsc.exe 7528 msdcsc.exe 7492 msdcsc.exe 6304 msdcsc.exe 7212 msdcsc.exe 3952 msdcsc.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\MBzeYmsBiawB\\MBzeYmsBiawB\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeSecurityPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeSystemtimePrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeBackupPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeRestorePrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeShutdownPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeDebugPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeUndockPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeManageVolumePrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeImpersonatePrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: 33 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: 34 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: 35 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: 36 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1520 msdcsc.exe Token: SeSecurityPrivilege 1520 msdcsc.exe Token: SeTakeOwnershipPrivilege 1520 msdcsc.exe Token: SeLoadDriverPrivilege 1520 msdcsc.exe Token: SeSystemProfilePrivilege 1520 msdcsc.exe Token: SeSystemtimePrivilege 1520 msdcsc.exe Token: SeProfSingleProcessPrivilege 1520 msdcsc.exe Token: SeIncBasePriorityPrivilege 1520 msdcsc.exe Token: SeCreatePagefilePrivilege 1520 msdcsc.exe Token: SeBackupPrivilege 1520 msdcsc.exe Token: SeRestorePrivilege 1520 msdcsc.exe Token: SeShutdownPrivilege 1520 msdcsc.exe Token: SeDebugPrivilege 1520 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1520 msdcsc.exe Token: SeChangeNotifyPrivilege 1520 msdcsc.exe Token: SeRemoteShutdownPrivilege 1520 msdcsc.exe Token: SeUndockPrivilege 1520 msdcsc.exe Token: SeManageVolumePrivilege 1520 msdcsc.exe Token: SeImpersonatePrivilege 1520 msdcsc.exe Token: SeCreateGlobalPrivilege 1520 msdcsc.exe Token: 33 1520 msdcsc.exe Token: 34 1520 msdcsc.exe Token: 35 1520 msdcsc.exe Token: 36 1520 msdcsc.exe Token: SeIncreaseQuotaPrivilege 996 msdcsc.exe Token: SeSecurityPrivilege 996 msdcsc.exe Token: SeTakeOwnershipPrivilege 996 msdcsc.exe Token: SeLoadDriverPrivilege 996 msdcsc.exe Token: SeSystemProfilePrivilege 996 msdcsc.exe Token: SeSystemtimePrivilege 996 msdcsc.exe Token: SeProfSingleProcessPrivilege 996 msdcsc.exe Token: SeIncBasePriorityPrivilege 996 msdcsc.exe Token: SeCreatePagefilePrivilege 996 msdcsc.exe Token: SeBackupPrivilege 996 msdcsc.exe Token: SeRestorePrivilege 996 msdcsc.exe Token: SeShutdownPrivilege 996 msdcsc.exe Token: SeDebugPrivilege 996 msdcsc.exe Token: SeSystemEnvironmentPrivilege 996 msdcsc.exe Token: SeChangeNotifyPrivilege 996 msdcsc.exe Token: SeRemoteShutdownPrivilege 996 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 4940 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 83 PID 1736 wrote to memory of 4940 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 83 PID 1736 wrote to memory of 4940 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 83 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 1736 wrote to memory of 4832 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 84 PID 4940 wrote to memory of 3020 4940 cmd.exe 86 PID 4940 wrote to memory of 3020 4940 cmd.exe 86 PID 4940 wrote to memory of 3020 4940 cmd.exe 86 PID 1736 wrote to memory of 1520 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 87 PID 1736 wrote to memory of 1520 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 87 PID 1736 wrote to memory of 1520 1736 a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe 87 PID 1520 wrote to memory of 5080 1520 msdcsc.exe 88 PID 1520 wrote to memory of 5080 1520 msdcsc.exe 88 PID 1520 wrote to memory of 5080 1520 msdcsc.exe 88 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 1520 wrote to memory of 1692 1520 msdcsc.exe 89 PID 5080 wrote to memory of 3764 5080 cmd.exe 91 PID 5080 wrote to memory of 3764 5080 cmd.exe 91 PID 5080 wrote to memory of 3764 5080 cmd.exe 91 PID 1520 wrote to memory of 996 1520 msdcsc.exe 92 PID 1520 wrote to memory of 996 1520 msdcsc.exe 92 PID 1520 wrote to memory of 996 1520 msdcsc.exe 92 PID 996 wrote to memory of 708 996 msdcsc.exe 93 PID 996 wrote to memory of 708 996 msdcsc.exe 93 PID 996 wrote to memory of 708 996 msdcsc.exe 93 PID 996 wrote to memory of 3508 996 msdcsc.exe 94 PID 996 wrote to memory of 3508 996 msdcsc.exe 94 PID 996 wrote to memory of 3508 996 msdcsc.exe 94 PID 996 wrote to memory of 3508 996 msdcsc.exe 94 PID 996 wrote to memory of 3508 996 msdcsc.exe 94 PID 996 wrote to memory of 3508 996 msdcsc.exe 94 PID 996 wrote to memory of 3508 996 msdcsc.exe 94 PID 996 wrote to memory of 3508 996 msdcsc.exe 94 PID 996 wrote to memory of 3508 996 msdcsc.exe 94 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 8372 attrib.exe 11876 attrib.exe 3764 attrib.exe 7552 attrib.exe 9576 attrib.exe 10592 attrib.exe 13132 attrib.exe 14100 attrib.exe 1400 attrib.exe 7988 attrib.exe 7368 attrib.exe 12964 attrib.exe 4492 attrib.exe 11564 attrib.exe 11920 attrib.exe 1332 attrib.exe 5900 attrib.exe 5492 attrib.exe 7176 attrib.exe 11452 attrib.exe 4400 attrib.exe 6764 attrib.exe 13740 attrib.exe 13680 attrib.exe 3948 attrib.exe 10116 attrib.exe 10708 attrib.exe 13448 attrib.exe 5780 attrib.exe 6948 attrib.exe 7212 attrib.exe 7740 attrib.exe 13776 attrib.exe 14048 attrib.exe 12632 attrib.exe 13132 attrib.exe 14100 attrib.exe 796 attrib.exe 9768 attrib.exe 11568 attrib.exe 12480 attrib.exe 9896 attrib.exe 10160 attrib.exe 13740 attrib.exe 14224 attrib.exe 4796 attrib.exe 9724 attrib.exe 8520 attrib.exe 12024 attrib.exe 10164 attrib.exe 11460 attrib.exe 12776 attrib.exe 13600 attrib.exe 2700 attrib.exe 5300 attrib.exe 7044 attrib.exe 8376 attrib.exe 1016 attrib.exe 2332 attrib.exe 9876 attrib.exe 10536 attrib.exe 2732 attrib.exe 7276 attrib.exe 7580 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\a39e406a9096eafa928a424f806c7282_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
PID:3020
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
PID:4832
-
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3764
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1692
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\msdcsc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe" +s +h4⤵PID:708
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\msdcsc.exe" +s +h5⤵
- Sets file to hidden
- Drops file in System32 directory
PID:4112
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
- System Location Discovery: System Language Discovery
PID:3508
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"4⤵
- Executes dropped EXE
- Modifies registry class
PID:2708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h5⤵PID:408
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h6⤵
- Views/modifies file attributes
PID:1016
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
- System Location Discovery: System Language Discovery
PID:4816
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5052 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h6⤵PID:3636
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h7⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2700
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad6⤵PID:1708
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"6⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h7⤵PID:2780
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h8⤵PID:4732
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad7⤵
- System Location Discovery: System Language Discovery
PID:4644
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:5032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h8⤵
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h9⤵PID:5092
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad8⤵PID:2368
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1336 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h9⤵
- System Location Discovery: System Language Discovery
PID:2208 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h10⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1400
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad9⤵PID:1772
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h10⤵PID:3280
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h11⤵PID:4100
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad10⤵PID:4920
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4420 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h11⤵PID:4836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h12⤵
- Sets file to hidden
PID:3708
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad11⤵PID:3388
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"11⤵
- Executes dropped EXE
- Modifies registry class
PID:220 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h12⤵PID:3304
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h13⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2332
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad12⤵
- System Location Discovery: System Language Discovery
PID:5056
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"12⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:3056 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h13⤵PID:4396
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h14⤵
- Views/modifies file attributes
PID:4796
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad13⤵PID:1460
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4612 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h14⤵PID:2620
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h15⤵
- Drops file in System32 directory
PID:1408
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad14⤵PID:1640
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:1172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h15⤵PID:3860
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h16⤵PID:380
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad15⤵PID:2376
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"15⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h16⤵PID:4780
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵PID:1336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h17⤵PID:4076
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad16⤵PID:3592
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h17⤵PID:3448
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h18⤵
- System Location Discovery: System Language Discovery
PID:4904
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad17⤵PID:376
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"17⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4548 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h18⤵PID:2956
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h19⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad18⤵PID:4616
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"18⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
PID:4924 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h19⤵PID:3812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h20⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1332
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad19⤵PID:2944
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"19⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h20⤵PID:1592
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵PID:1568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h21⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:796
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad20⤵PID:3108
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"20⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:1440 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h21⤵PID:796
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h22⤵
- Sets file to hidden
PID:5140
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad21⤵PID:3200
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"21⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
PID:5160 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h22⤵PID:5216
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h23⤵
- Views/modifies file attributes
PID:5300
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad22⤵PID:5224
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"22⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:5316 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h23⤵PID:5368
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h24⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
PID:5448
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad23⤵PID:5376
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:5468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h24⤵PID:5520
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h25⤵
- System Location Discovery: System Language Discovery
PID:5600
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad24⤵PID:5528
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"24⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h25⤵PID:5672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h26⤵PID:5752
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad25⤵
- System Location Discovery: System Language Discovery
PID:5680
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:5768 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h26⤵
- System Location Discovery: System Language Discovery
PID:5820 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h27⤵
- Views/modifies file attributes
PID:5900
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad26⤵PID:5828
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"26⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:5916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h27⤵PID:6000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h28⤵PID:6084
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad27⤵PID:6008
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"27⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:6116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h28⤵PID:1056
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵PID:1440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h29⤵PID:5304
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad28⤵PID:4732
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"28⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5200 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h29⤵PID:5396
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h30⤵
- Drops file in System32 directory
PID:5540
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad29⤵PID:5460
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"29⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5608 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h30⤵PID:5628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h31⤵
- Views/modifies file attributes
PID:5780
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad30⤵PID:5692
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:5904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h31⤵PID:5768
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h32⤵PID:5996
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad31⤵PID:5928
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"31⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h32⤵PID:1716
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h33⤵PID:6120
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad32⤵PID:6124
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"32⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:6116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h33⤵PID:5188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h34⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:5492
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad33⤵PID:5164
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"33⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:5468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h34⤵PID:5784
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h35⤵PID:6120
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad34⤵PID:5788
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"34⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:432 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h35⤵PID:5600
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h36⤵
- Sets file to hidden
PID:3940
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad35⤵PID:5480
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"35⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:5916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h36⤵PID:5464
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h37⤵
- Sets file to hidden
PID:6148
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad36⤵PID:5504
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:6164 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h37⤵PID:6216
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h38⤵PID:6296
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad37⤵
- System Location Discovery: System Language Discovery
PID:6224
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"37⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6328 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h38⤵PID:6376
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h39⤵
- System Location Discovery: System Language Discovery
PID:6456
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad38⤵PID:6384
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:6472 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h39⤵PID:6520
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h40⤵
- Drops file in System32 directory
PID:6600
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad39⤵
- System Location Discovery: System Language Discovery
PID:6528
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"39⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
PID:6620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h40⤵PID:6668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h41⤵PID:6748
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad40⤵
- System Location Discovery: System Language Discovery
PID:6676
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"40⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6764 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h41⤵PID:6812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h42⤵
- Sets file to hidden
PID:6900
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad41⤵PID:6820
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:6916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h42⤵PID:6964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h43⤵
- Sets file to hidden
- Views/modifies file attributes
PID:7044
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad42⤵PID:6972
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"42⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:7060 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h43⤵
- System Location Discovery: System Language Discovery
PID:7112 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h44⤵PID:5996
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad43⤵
- System Location Discovery: System Language Discovery
PID:7120
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"43⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:2372 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h44⤵PID:6308
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h45⤵
- Drops file in System32 directory
PID:6360
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad44⤵
- System Location Discovery: System Language Discovery
PID:6196
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:6344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h45⤵PID:6612
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h46⤵PID:6608
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad45⤵PID:6504
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"45⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h46⤵PID:6908
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h47⤵PID:6948
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad46⤵
- System Location Discovery: System Language Discovery
PID:6796
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:6936 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h47⤵PID:5604
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h48⤵
- Drops file in System32 directory
PID:6360
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad47⤵PID:5996
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"47⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:6332 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h48⤵PID:6644
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h49⤵
- Sets file to hidden
- Views/modifies file attributes
PID:6948
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad48⤵PID:6484
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"48⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:6656 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h49⤵PID:6236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h50⤵PID:6776
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad49⤵PID:5916
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5932 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h50⤵PID:6244
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h51⤵
- Views/modifies file attributes
PID:7176
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad50⤵PID:2372
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"50⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:7192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h51⤵PID:7240
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h52⤵PID:7320
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad51⤵
- System Location Discovery: System Language Discovery
PID:7248
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"51⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
PID:7340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h52⤵
- System Location Discovery: System Language Discovery
PID:7388 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h53⤵
- Sets file to hidden
PID:7468
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad52⤵PID:7396
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"52⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:7484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h53⤵PID:7532
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h54⤵PID:7612
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad53⤵PID:7540
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"53⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:7632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h54⤵PID:7680
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h55⤵
- Sets file to hidden
PID:7792
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad54⤵PID:7688
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"54⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:7828 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h55⤵PID:7908
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h56⤵
- Sets file to hidden
- Views/modifies file attributes
PID:7988
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad55⤵PID:7916
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"55⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
PID:8008 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h56⤵PID:8060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h57⤵PID:8152
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad56⤵
- System Location Discovery: System Language Discovery
PID:8072
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"56⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:8168 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h57⤵PID:6476
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h58⤵PID:7204
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad57⤵PID:6488
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"57⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:7200 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h58⤵PID:7344
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵PID:7340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h59⤵PID:7524
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad58⤵
- System Location Discovery: System Language Discovery
PID:7384
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"58⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:7492 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h59⤵PID:7796
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h60⤵
- Sets file to hidden
PID:7996
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad59⤵PID:7800
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"59⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:7892 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h60⤵
- System Location Discovery: System Language Discovery
PID:7832 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h61⤵
- Drops file in System32 directory
PID:8012
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad60⤵PID:8020
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"60⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies registry class
PID:8028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h61⤵PID:7236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h62⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:7552
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad61⤵PID:3084
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:7528 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h62⤵
- System Location Discovery: System Language Discovery
PID:7192 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h63⤵PID:1804
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad62⤵PID:7200
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:7492 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h63⤵PID:7904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h64⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:7212
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad63⤵PID:2484
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"63⤵
- Executes dropped EXE
- Modifies registry class
PID:6304 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h64⤵PID:664
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h65⤵PID:7852
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad64⤵PID:4404
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"64⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:7212 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h65⤵
- System Location Discovery: System Language Discovery
PID:7196 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h66⤵
- Views/modifies file attributes
PID:7368
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad65⤵PID:4776
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:3952 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h66⤵PID:2320
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵PID:7492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h67⤵PID:8228
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad66⤵PID:8056
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"66⤵
- Checks computer location settings
- Drops file in System32 directory
PID:8244 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h67⤵
- System Location Discovery: System Language Discovery
PID:8296 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h68⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:8376
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad67⤵
- System Location Discovery: System Language Discovery
PID:8304
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"67⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
PID:8396 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h68⤵PID:8444
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h69⤵PID:8524
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad68⤵PID:8452
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"68⤵
- Checks computer location settings
- Drops file in System32 directory
PID:8548 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h69⤵
- System Location Discovery: System Language Discovery
PID:8596 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h70⤵
- Sets file to hidden
PID:8676
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad69⤵
- System Location Discovery: System Language Discovery
PID:8604
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"69⤵
- Adds Run key to start application
- Modifies registry class
PID:8688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h70⤵PID:8748
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h71⤵
- Sets file to hidden
PID:8828
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad70⤵PID:8756
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"70⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:8844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h71⤵PID:8892
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h72⤵
- Sets file to hidden
PID:8972
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad71⤵PID:8900
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"71⤵
- Checks computer location settings
- Adds Run key to start application
PID:8988 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h72⤵PID:9040
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h73⤵PID:9120
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad72⤵PID:9048
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"72⤵
- Checks computer location settings
PID:9136 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h73⤵
- System Location Discovery: System Language Discovery
PID:9184 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h74⤵PID:7472
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad73⤵PID:9192
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"73⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:8384 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h74⤵PID:8404
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h75⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
PID:8440
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad74⤵PID:8244
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"74⤵
- Checks computer location settings
- Adds Run key to start application
PID:4648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h75⤵PID:8700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h76⤵
- Sets file to hidden
PID:8704
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad75⤵PID:8568
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"75⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
PID:8736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h76⤵PID:8972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h77⤵PID:9124
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad76⤵PID:8872
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"76⤵
- Checks computer location settings
- Adds Run key to start application
PID:9020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h77⤵PID:5444
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h78⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:7740
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad77⤵PID:9204
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"77⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
PID:8276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h78⤵PID:8396
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h79⤵PID:8696
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad78⤵PID:8564
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"78⤵
- Adds Run key to start application
- Modifies registry class
PID:8292 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h79⤵PID:4648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h80⤵PID:8736
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad79⤵PID:5896
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"79⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6080 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h80⤵PID:9008
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h81⤵
- Sets file to hidden
PID:9140
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad80⤵PID:9016
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"80⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5596 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h81⤵PID:6036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h82⤵PID:9152
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad81⤵PID:2380
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"81⤵
- Modifies WinLogon for persistence
PID:5248 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h82⤵PID:8616
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:9140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h83⤵PID:5596
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad82⤵PID:9168
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"82⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5388 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h83⤵PID:3924
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h84⤵
- Sets file to hidden
- Drops file in System32 directory
PID:9284
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad83⤵PID:9164
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"83⤵
- Checks computer location settings
- Modifies registry class
PID:9304 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h84⤵PID:9352
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h85⤵PID:9432
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad84⤵PID:9360
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"84⤵
- Modifies registry class
PID:9448 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h85⤵PID:9496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h86⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:9576
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad85⤵PID:9504
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"85⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
PID:9592 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h86⤵PID:9644
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h87⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:9724
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad86⤵PID:9652
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"86⤵
- Adds Run key to start application
PID:9740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h87⤵PID:9788
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h88⤵PID:9868
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad87⤵
- System Location Discovery: System Language Discovery
PID:9796
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"87⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:9888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h88⤵PID:9936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h89⤵
- Drops file in System32 directory
PID:10016
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad88⤵PID:9944
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"88⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
PID:10032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h89⤵PID:10084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h90⤵
- Views/modifies file attributes
PID:10164
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad89⤵PID:10092
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"89⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
PID:10184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h90⤵PID:10232
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h91⤵
- Sets file to hidden
PID:1980
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad90⤵PID:8684
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"90⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
PID:9380 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h91⤵PID:9320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h92⤵PID:9464
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad91⤵PID:9308
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"91⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:9488 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h92⤵PID:9724
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h93⤵
- Sets file to hidden
- Views/modifies file attributes
PID:9876
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad92⤵PID:9624
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"92⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
PID:9764 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h93⤵PID:9956
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h94⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:9896
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad93⤵PID:10020
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"93⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
PID:9884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h94⤵
- System Location Discovery: System Language Discovery
PID:10080 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h95⤵
- Sets file to hidden
PID:10208
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad94⤵PID:10052
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"94⤵
- Checks computer location settings
- Adds Run key to start application
PID:10224 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h95⤵
- System Location Discovery: System Language Discovery
PID:9600 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV196⤵PID:9432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h96⤵
- Views/modifies file attributes
PID:9768
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad95⤵PID:9464
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"95⤵
- Modifies WinLogon for persistence
- Modifies registry class
PID:4308 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h96⤵PID:7820
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:9888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h97⤵PID:10104
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad96⤵PID:10016
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"96⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
PID:10200 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h97⤵PID:10060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h98⤵PID:10220
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad97⤵PID:10056
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"97⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:6252 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h98⤵PID:9672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h99⤵PID:10176
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad98⤵PID:9448
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"98⤵
- Checks computer location settings
- Modifies registry class
PID:6748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h99⤵PID:6744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h100⤵PID:6952
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad99⤵PID:10176
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"99⤵
- Checks computer location settings
- Modifies registry class
PID:10256 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h100⤵PID:10304
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h101⤵
- Sets file to hidden
PID:10384
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad100⤵PID:10312
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"100⤵
- Modifies WinLogon for persistence
- Modifies registry class
PID:10404 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h101⤵PID:10452
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h102⤵
- Drops file in System32 directory
PID:10532
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad101⤵PID:10460
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"101⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
PID:10548 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h102⤵PID:10596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h103⤵PID:10676
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad102⤵
- System Location Discovery: System Language Discovery
PID:10604
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"102⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:10696 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h103⤵PID:10744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h104⤵
- Sets file to hidden
PID:10824
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad103⤵PID:10752
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"103⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:10840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h104⤵PID:10888
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h105⤵PID:10968
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad104⤵PID:10896
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"104⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:10988 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h105⤵PID:11044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h106⤵
- System Location Discovery: System Language Discovery
PID:11128
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad105⤵PID:11052
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"105⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
PID:11144 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h106⤵PID:11192
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h107⤵PID:10248
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad106⤵PID:11200
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"106⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
PID:10208 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h107⤵PID:10388
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h108⤵
- Views/modifies file attributes
PID:10536
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad107⤵PID:10392
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"107⤵
- Modifies WinLogon for persistence
PID:7436 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h108⤵PID:10412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h109⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:10592
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad108⤵PID:10404
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"108⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:10772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h109⤵
- System Location Discovery: System Language Discovery
PID:10712 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h110⤵
- Sets file to hidden
PID:10864
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad109⤵PID:10700
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"109⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:10880 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h110⤵PID:11132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h111⤵
- Sets file to hidden
PID:2836
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad110⤵PID:11136
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"110⤵
- Modifies WinLogon for persistence
- Checks computer location settings
PID:10984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h111⤵PID:11148
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h112⤵PID:7824
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad111⤵PID:11180
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"111⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6756 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h112⤵PID:10556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h113⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
PID:8000
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad112⤵PID:10548
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"112⤵
- Modifies WinLogon for persistence
- Modifies registry class
PID:10856 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h113⤵PID:10828
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1114⤵PID:10772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h114⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4492
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad113⤵PID:7784
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"113⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:212 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h114⤵PID:10720
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h115⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
PID:1704
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad114⤵PID:4364
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"114⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:11176 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h115⤵PID:4032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h116⤵PID:7488
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad115⤵PID:4208
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"115⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:6756 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h116⤵PID:3064
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h117⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4400
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad116⤵PID:2244
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"116⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Modifies registry class
PID:2012 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h117⤵
- System Location Discovery: System Language Discovery
PID:10840 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h118⤵
- Sets file to hidden
PID:3228
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad117⤵PID:212
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"117⤵
- Modifies registry class
PID:10172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h118⤵PID:4400
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h119⤵PID:632
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad118⤵PID:2392
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"118⤵
- Modifies WinLogon for persistence
- Modifies registry class
PID:5040 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h119⤵PID:11040
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h120⤵
- Sets file to hidden
- Views/modifies file attributes
PID:8372
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad119⤵PID:10880
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"119⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
PID:8220 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h120⤵PID:1760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h121⤵
- Views/modifies file attributes
PID:8520
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad120⤵PID:2700
-
-
C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"C:\Windows\system32\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe"120⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1488 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\MBzeYmsBiawB\MBzeYmsBiawB\msdcsc.exe" +s +h121⤵PID:8820
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1122⤵PID:8520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-