darkcomet | 08f61de703b5962e4339d1c768c0b8fe9591c655992cb68bd9e9176e85a8488d

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Size

752KB
MD5

95da3ebd31c00ef9c5186a0af6796440
SHA1

9e84a580f9af68bc1dd96431223f8d2ce87800d8
SHA256

08f61de703b5962e4339d1c768c0b8fe9591c655992cb68bd9e9176e85a8488d
SHA512

b0647d42c3f32363a7fe0b62298c9a1522fe8bc98be7c97da4b52f7a51bac1a7d32a458e1ddc474d8ed162f672eadaf277f4ed4a296540d672ae8dd47b1e95b6
SSDEEP

12288:IyZQUGtG0ubNtDTP4E9EjX6xvRYoAP//GUF4VkJhwv/Bb14Y0IY8lLAYqKenF18:ISQyHHPV86bYT//5Xqb4Y0QBAY7z

Score

10^/10

darkcomet guest16 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

203.109.175.203:100

Mutex

DC_MUTEX-38KS9JC

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
aiqNb0K2JC2x
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe

Executes dropped EXE 2 IoCs

pid	Process
4244	msdcsc.exe
5208	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI5	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
File opened for modification	C:\Windows\PCGWIN32.LI5	msdcsc.exe
File opened for modification	C:\Windows\PCGWIN32.LI5	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}\ = 8aa96115e8e061afba53de8f78acdc70fee023a39f4ffcf32390bf7edce203879f6bbcf75fa40384d73b34df16fc349da83d0d9d0dfd11e2bdeee2b32fd0b37ce86035e699ab86506bce574d7b92e776b454e905317551a50d766e5ab23829606ea9f22927291b517f09638d972d4451164534a5a8362a2a2e36f3da2108d41a14c2867965a2c9a0aa838e1f4dc311f70954b14819f2c5e87a2d2051740e56b2e7d19bf587e6248594098b7548a6124ac616d534c56846c81a0900f5e19aa9f98a2671d411b7f9e41e29fd956146659b65bf155cfac226572a8416488472f52955adb5f2d6e84a2d966dcb6db751e43ee7a26bd72f044c848c4bf1575efbc2983f7a23e05f78439ebf7d5c5d003dfb611fb603243706ab740f2413b6071a9b46f89b207fb023ae5f4dc3111039fcd9a386c79a54017889e056c8ca0d9071c11aeef80c5fae3cb21e97820b5e4fbcb39dd0bd841ecbfc2821716de1324ad0ae37931b8707c4cb976f0b13b7cf6453ba37a7db9b47c0cb994f05f3b92862f6c69bcbb80f1893c4c0191a79be21e3bd771deb41cf922c3090dec13d3e5d5d7d019e6dfc91e3fadf60fccae2f6f11b9287fed45d35be56a2044786fb04a0ea9d6f3d73e167321b16bf0423da0787c4a484f85b6547556bb5f7ea5bce87cde48eb40ce54c3a6c676c3b2f67538bc737db2b00f06ae42fab9348086e2e126cc11329c70d14113a8126c29a163e846296587b8067d12bf1b71d31e9902f48642cd8c5b910ad3b7b5aab83b7c4ee66fdca1adbb25cb0cbc126e14b6003b159fc446e97303e35ddecbd0de20d312d528d002d5211800522b5162504459a790065fa412775f4169a8a793159213d259dd90146e9d41277ffdba33888e26db9519d0502cac8ee09b3092731cbe948aa14ee0873945ff98326c0a4e8f53156918a71899df2c29691053dfa5d1ebec22291008118428456184478185a84465b2b876fabf3b0dfed7c8d1fee033347a70484a6a8f50b1a97c074e9d8aa82c8b71554850849cab5d7d6fbca60cf2ef372a858c9ba2e21cc0591058a46f6545bfab8a65e9b4207d86b87d7747bea67698bae304c200e1e7282d8e9c7524bce4f138c78f01c93be085d74c156fe74e22a594e398d6551b94121fd49deb57ce62294160574a9d696f48427278b9b77789ba2f8a0a7dd6bbecf228c986ebcac9f9103497711eb052fb5736a17afbb9318b8ff2063d217010b09cf31ecd5924a7fd063030fe7b3db2f40f31f58c37c00a234362414d80a4270f8685e96c24529f50d95d1c67ddb1d47fdfb61e7f5341ae50665d4594445e6f535652965c9954d060d1a0d3e91a27ec7a304a79644bbc8a755e4baa59e354395df7abca65d6bc137521bbfc763b467a834355699fa86e65b350755fb49204d3c511c0d7d9121f1952e76acaa6c6fb033a1178dcb6e8833576f7bd367c71b04c776345adb8047f32be717e4bb9727cb3b50e078e8dcb1fc6a61b0419bedc0ed9e4ec31308f7ac14933a8720e4c8f76a2b2eb7f2ab6e70cc2c4cf3ac2f4df34d98cd41cd9d72421fc8c3ec100d32add8d2477fcbe30808ea28b152ed462ecaac6fb073d397800b384fa4d3f847198bb98fa5ecca91480956f1ca1ee90236586a382ea4ec15720918f1c0e6279a3b7927599b7d381d5abd405e8dc20df60deb516f0133b527159b493fb2e32e702c621066843468ea54f1fadddfbe3c5da2814782a4a8d42fb79314b0b696ab3bf758948479c5e146a2a487a5cbb950e678eb9c37fddbe180c28afe51e33df71d94810901b5c1a626aafb715f26031a4086522ac62e944cf9cc22cc7f4f232c4fcc9353f8cf644ccaadd671c555b90666648af671e42d4bd130fed69c4b43306fe21361bfd95c06fe24e3e4e7b9649a04fe185d864125a9d61274c016f73a94a0c432351ee53cc59eba3c21e25947bd3b1e5f3c835ef0039ef73d549d3bbe275d5b3dff1d1c813e322216a8c456f97ae5d886bb24a0eade4f835300b7901bcf7f2ca38ce093828737049be6b805a679156576a9aa2a0f306c5ad0f839db2147595b05ff899c327d169e34bca6630beff04c18d2c6496b8a17680b52f0fedaddc141597501e56ee69225cf658c49ed96cd0472eae0091b6d3f3123a950154235d02574b9685dac8153aef7aceb6de80e5452f6c02a1316cf7bcc27507b0e67f2fb56a0fafd60e1b43e59e3454fd953be8f624ce8eca9aca9adf24e6e52ac4e6dd26d7ff163969f4a7cf0dc9783bbf020d0b237979bfbb8a0617d61a269d629bbf160d681b4b52b5aaf076c2b8e4facf3af18ec04ecd8737d1fe1431e4fc2d3c6886bd577f5ab6a08282c2e10acfcf36118c5844a8bb7506b020f3e539cffc11c2afe499d35fd6562a591058d755299c0057f659c85bef65d94c1f58adaa93e299cd1fdc9618e8dd3ce4f5293ce40325018ce41cc3d6d610ea9ccce0d9211c73de4dd767dea1dd6fdc55d5901c1f531266d740d66728598e9ff925c318251a1b9de66c2746fd6d3b5c855cc8573aad7a8046d08f1346a59b14551b94125dd65be85a3cadf4ebcec1dee41f341af750c15b2b9a7257459267d04a1982ef9321e1082fee7a324a0a6ccfb5120758cd98f864c9a10ff349ca63e15620948f176ee54cc0853ae07125b4e7f93e337b01be307c7bb545f0a4376df5abcc66365c7a984f6499bcd07728baf50738417b93b9da7fe649d46fe3a1c9e82fcb6239baff8b39ca00168d6364a2a4eae8c534d7ff123ed7732dbdfc043151f497c71629288c60c9530061084b2b516a5045606fa84a7c9b42d2871d6e50b790f9933faaf580cf810da003f86a365808aaef0cddbee38329e9083b2bf671c2bfce8213651244d4bad37d25bc847cfab8c50ee002debd10f82139840054089e08a8488b9535a0846480acab6d66b35976544750899d0c6f7abeb2f88b349af4d8c6d50f1f6ae5aed86f1bb529f003c409c8081c3bd771edbfcff1ddc3d42ddc082ecd7317bea6750db78f8a65e153c09222d9e727d10a278fe58a3c0608383afff4cdc0e03edafd14cf68f54b3c4602ad210497ff163128fc033fa6f61d3323fe0235d68fd1662749958b9be9e1d4201eed94c82d0594c45ec550fc51366f79a5bc1c75a4bc6cf3b0c60ee04ad6a8eae0ccdec91d2ce7fcd1c6d00ed7211e63df5211abd46e25a3e78a220f95c5dbdc121d1350615ebf5afaa6cb66eeb726f2e73d398fffe9ce34138795a1d38bda05eccfcefde0cfdac5d6ffd73dd273e8be3d757047bb65f94c3c547967b0a5fa803eab737549b847f94638b08f056d6844b09cf292c490ef54c26121a47064bc4ef9973b9a71e8bfca823147f446388b712e436b52a198e81cdfd4de2f137296b6d17ed8b51cf850cc6ac9a6cf99026f784db95007abc58a27a911e31bce95fd5c3b6e8dbec38b39c17bdbbe19fbe7c1d207de59d153ef9dc9e017d3d5ddd4142e9c09243bedf633c0fe2ece8ccabad282d56cd4a0e893211660d7a4dd83145d1b971a6ddf53ea922ea0ee9b269272d3b4e6772ebd8c8804ebf6c238f8fd3b3c858f642e568c5d0da7ef8a29b8ec0ed6acea82c8b8c57d3cb0f6fb393af486c56520a4e4832ca9ed1433aff5ea37cd85e037c78	msdcsc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}\ = 815cc1ece8e061afba53de8f78acdc70fee023a39f4ffcf32390bf7edce203879f6bbcf75fa40384d73b34df16fc349da83d0d9d0dfd11e2bdeee2b32fd0b37ce86035e699ab86506bce574d7b92e776b454e905317551a50d766e5ab23829606ea9f22927291b517f09638d972d4451164534a5a8362a2a2e36f3da2108d41a14c2867965a2c9a0aa838e1f4dc311f70954b14819f2c5e87a2d2051740e56b2e6d19bf587e6248594098b7548a6124ac616d534c56846c81a0900f5e19aa9f98a2671d411b7f9e41e29fd956146659b65bf155cfac226572a8416488472f52955adb5f2d6e84a2d966dcb6db751e43ee7a26bd72f044c848c4bf1575efbc2983f7a23e05f78439ebf7d5c5d003dfb611fb603243706ab740f2413b6071a9b46f89b207fb023ae5f4dc3111039fcd9a386c79a54017889e056c8ca0d9071c11aeef80c5fae3cb21e97820b5e4fbcb39dd0bd841ecbfc2821716de1324ad0ae37931b8707c4cb976f0b13b7cf6453ba37a7db9b47c0cb994f05f3b92862f6c69bcbb80f1893c4c0191a79be21e3bd771deb41cf922c3090dec13d3e5d5d7d019e6dfc91e3fadf60fccae2f6f11b9287fed45d35be56a2044786fb04a0ea9d6f3d73e167321b16bf0423da0787c4a484f85b6547556bb5f7ea5bce87cde48eb40ce54c3a6c676c3b2f67538bc737db2b00f06ae42fab9348086e2e126cc11329c70d14113a8126c29a163e846296587b8067d12bf1b71d31e9902f48642cd8c5b910ad3b7b5aab83b7c4ee66fdca1adbb25cb0cbc126e14b6003b159fc446e97303e35ddecbd0de20d312d528d002d5211800522b5162504459a790065fa412775f4169a8a793159213d259dd90146e9d41277ffdba33888e26db9519d0502cac8ee09b3092731cbe948aa14ee0873945ff98326c0a4e8f53156918a71899df2c29691053dfa5d1ebec22291008118428456184478185a84465b2b876fabf3b0dfed7c8d1fee033347a70484a6a8f50b1a97c074e9d8aa82c8b71554850849cab5d7d6fbca60cf2ef372a858c9ba2e21cc0591058a46f6545bfab8a65e9b4207d86b87d7747bea67698bae304c200e1e7282d8e9c7524bce4f138c78f01c93be085d74c156fe74e22a594e398d6551b94121fd49deb57ce62294160574a9d696f48427278b9b77789ba2f8a0a7dd6bbecf228c986ebcac9f9103497711eb052fb5736a17afbb9318b8ff2063d217010b09cf31ecd5924a7fd063030fe7b3db2f40f31f58c37c00a234362414d80a4270f8685e96c24529f50d95d1c67ddb1d47fdfb61e7f5341ae50665d4594445e6f535652965c9954d060d1a0d3e91a27ec7a304a79644bbc8a755e4baa59e354395df7abca65d6bc137521bbfc763b467a834355699fa86e65b350755fb49204d3c511c0d7d9121f1952e76acaa6c6fb033a1178dcb6e8833576f7bd367c71b04c776345adb8047f32be717e4bb9727cb3b50e078e8dcb1fc6a61b0419bedc0ed9e4ec31308f7ac14933a8720e4c8f76a2b2eb7f2ab6e70cc2c4cf3ac2f4df34d98cd41cd9d72421fc8c3ec100d32add8d2477fcbe30808ea28b152ed462ecaac6fb073d397800b384fa4d3f847198bb98fa5ecca91480956f1ca1ee90236586a382ea4ec15720918f1c0e6279a3b7927599b7d381d5abd405e8dc20df60deb516f0133b527159b493fb2e32e702c621066843468ea54f1fadddfbe3c5da2814782a4a8d42fb79314b0b696ab3bf758948479c5e146a2a487a5cbb950e678eb9c37fddbe180c28afe51e33df71d94810901b5c1a626aafb715f26031a4086522ac62e944cf9cc22cc7f4f232c4fcc9353f8cf644ccaadd671c555b90666648af671e42d4bd130fed69c4b43306fe21361bfd95c06fe24e3e4e7b9649a04fe185d864125a9d61274c016f73a94a0c432351ee53cc59eba3c21e25947bd3b1e5f3c835ef0039ef73d549d3bbe275d5b3dff1d1c813e322216a8c456f97ae5d886bb24a0eade4f835300b7901bcf7f2ca38ce093828737049be6b805a679156576a9aa2a0f306c5ad0f839db2147595b05ff899c327d169e34bca6630beff04c18d2c6496b8a17680b52f0fedaddc141597501e56ee69225cf658c49ed96cd0472eae0091b6d3f3123a950154235d02574b9685dac8153aef7aceb6de80e5452f6c02a1316cf7bcc27507b0e67f2fb56a0fafd60e1b43e59e3454fd953be8f624ce8eca9aca9adf24e6e52ac4e6dd26d7ff163969f4a7cf0dc9783bbf020d0b237979bfbb8a0617d61a269d629bbf160d681b4b52b5aaf076c2b8e4facf3af18ec04ecd8737d1fe1431e4fc2d3c6886bd577f5ab6a08282c2e10acfcf36118c5844a8bb7506b020f3e539cffc11c2afe499d35fd6562a591058d755299c0057f659c85bef65d94c1f58adaa93e299cd1fdc9618e8dd3ce4f5293ce40325018ce41cc3d6d610ea9ccce0d9211c73de4dd767dea1dd6fdc55d5901c1f531266d740d66728598e9ff925c318251a1b9de66c2746fd6d3b5c855cc8573aad7a8046d08f1346a59b14551b94125dd65be85a3cadf4ebcec1dee41f341af750c15b2b9a7257459267d04a1982ef9321e1082fee7a324a0a6ccfb5120758cd98f864c9a10ff349ca63e15620948f176ee54cc0853ae07125b4e7f93e337b01be307c7bb545f0a4376df5abcc66365c7a984f6499bcd07728baf50738417b93b9da7fe649d46fe3a1c9e82fcb6239baff8b39ca00168d6364a2a4eae8c534d7ff123ed7732dbdfc043151f497c71629288c60c9530061084b2b516a5045606fa84a7c9b42d2871d6e50b790f9933faaf580cf810da003f86a365808aaef0cddbee38329e9083b2bf671c2bfce8213651244d4bad37d25bc847cfab8c50ee002debd10f82139840054089e08a8488b9535a0846480acab6d66b35976544750899d0c6f7abeb2f88b349af4d8c6d50f1f6ae5aed86f1bb529f003c409c8081c3bd771edbfcff1ddc3d42ddc082ecd7317bea6750db78f8a65e153c09222d9e727d10a278fe58a3c0608383afff4cdc0e03edafd14cf68f54b3c4602ad210497ff163128fc033fa6f61d3323fe0235d68fd1662749958b9be9e1d4201eed94c82d0594c45ec550fc51366f79a5bc1c75a4bc6cf3b0c60ee04ad6a8eae0ccdec91d2ce7fcd1c6d00ed7211e63df5211abd46e25a3e78a220f95c5dbdc121d1350615ebf5afaa6cb66eeb726f2e73d398fffe9ce34138795a1d38bda05eccfcefde0cfdac5d6ffd73dd273e8be3d757047bb65f94c3c547967b0a5fa803eab737549b847f94638b08f056d6844b09cf292c490ef54c26121a47064bc4ef9973b9a71e8bfca823147f446388b712e436b52a198e81cdfd4de2f137296b6d17ed8b51cf850cc6ac9a6cf99026f784db95007abc58a27a911e31bce95fd5c3b6e8dbec38b39c17bdbbe19fbe7c1d207de59d153ef9dc9e017d3d5ddd4142e9c09243bedf633c0fe2ece8ccabad282d56cd4a0e893211660d7a4dd83145d1b971a6ddf53ea922ea0ee9b269272d3b4e6772ebd8c8804ebf6c238f8fd3b3c858f642e568c5d0da7ef8a29b8ec0ed6acea82c8b8c57d3cb0f6fb393af486c56520a4e4832ca9ed1433aff5ea37cd85e037c78	msdcsc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}\ = 4bfc9043e8e061afba53de8f78acdc70fee023a39f4ffcf32390bf7edce203879f6bbcf75fa40384d73b34df16fc349da83d0d9d0dfd11e2bdeee2b32fd0b37ce86035e699ab86506bce574d7b92e776b454e905317551a50d766e5ab23829606ea9f22927291b517f09638d972d4451164534a5a8362a2a2e36f3da2108d41a14c2867965a2c9a0aa838e1f4dc311f70954b14819f2c5e87a2d2051740e56b2e6d19bf587e6248594098b7548a6124ac616d534c56846c81a0900f5e19aa9f98a2671d411b7f9e41e29fd956146659b65bf155cfac226572a8416488472f52955adb5f2d6e84a2d966dcb6db751e43ee7a26bd72f044c848c4bf1575efbc2983f7a23e05f78439ebf7d5c5d003dfb611fb603243706ab740f2413b6071a9b46f89b207fb023ae5f4dc3111039fcd9a386c79a54017889e056c8ca0d9071c11aeef80c5fae3cb21e97820b5e4fbcb39dd0bd841ecbfc2821716de1324ad0ae37931b8707c4cb976f0b13b7cf6453ba37a7db9b47c0cb994f05f3b92862f6c69bcbb80f1893c4c0191a79be21e3bd771deb41cf922c3090dec13d3e5d5d7d019e6dfc91e3fadf60fccae2f6f11b9287fed45d35be56a2044786fb04a0ea9d6f3d73e167321b16bf0423da0787c4a484f85b6547556bb5f7ea5bce87cde48eb40ce54c3a6c676c3b2f67538bc737db2b00f06ae42fab9348086e2e126cc11329c70d14113a8126c29a163e846296587b8067d12bf1b7de2cc6902f48642cd8c5b910ad3b7b5aab83b7c4ee66fdca1adbb25cb0cbc126e14b6003b159fc446e97303e35ddecbd0de20d312d528d002d5211800522b5162504459a790065fa412775f4169a8a793159213d259dd90146e9d41277ffdba33888e26db9519d0502cac8ee09b3092731cbe948aa14ee0873945ff98326c0a4e8f53156918a71899df2c29691053dfa5d1ebec22291008118428456184478185a84465b2b876fabf3b0dfed7c8d1fee033347a70484a6a8f50b1a97c074e9d8aa82c8b71554850849cab5d7d6fbca60cf2ef372a858c9ba2e21cc0591058a46f6545bfab8a65e9b4207d86b87d7747bea67698bae304c200e1e7282d8e9c7524bce4f138c78f01c93be085d74c156fe74e22a594e398d6551b94121fd49deb57ce62294160574a9d696f48427278b9b77789ba2f8a0a7dd6bbecf228c986ebcac9f9103497711eb052fb5736a17afbb9318b8ff2063d217010b09cf31ecd5924a7fd063030fe7b3db2f40f31f58c37c00a234362414d80a4270f8685e96c24529f50d95d1c67ddb1d47fdfb61e7f5341ae50665d4594445e6f535652965c9954d060d1a0d3e91a27ec7a304a79644bbc8a755e4baa59e354395df7abca65d6bc137521bbfc763b467a834355699fa86e65b350755fb49204d3c511c0d7d9121f1952e76acaa6c6fb033a1178dcb6e8833576f7bd367c71b04c776345adb8047f32be717e4bb9727cb3b50e078e8dcb1fc6a61b0419bedc0ed9e4ec31308f7ac14933a8720e4c8f76a2b2eb7f2ab6e70cc2c4cf3ac2f4df34d98cd41cd9d72421fc8c3ec100d32add8d2477fcbe30808ea28b152ed462ecaac6fb073d397800b384fa4d3f847198bb98fa5ecca91480956f1ca1ee90236586a382ea4ec15720918f1c0e6279a3b7927599b7d381d5abd405e8dc20df60deb516f0133b527159b493fb2e32e702c621066843468ea54f1fadddfbe3c5da2814782a4a8d42fb79314b0b696ab3bf758948479c5e146a2a487a5cbb950e678eb9c37fddbe180c28afe51e33df71d94810901b5c1a626aafb715f26031a4086522ac62e944cf9cc22cc7f4f232c4fcc9353f8cf644ccaadd671c555b90666648af671e42d4bd130fed69c4b43306fe21361bfd95c06fe24e3e4e7b9649a04fe185d864125a9d61274c016f73a94a0c432351ee53cc59eba3c21e25947bd3b1e5f3c835ef0039ef73d549d3bbe275d5b3dff1d1c813e322216a8c456f97ae5d886bb24a0eade4f835300b7901bcf7f2ca38ce093828737049be6b805a679156576a9aa2a0f306c5ad0f839db2147595b05ff899c327d169e34bca6630beff04c18d2c6496b8a17680b52f0fedaddc141597501e56ee69225cf658c49ed96cd0472eae0091b6d3f3123a950154235d02574b9685dac8153aef7aceb6de80e5452f6c02a1316cf7bcc27507b0e67f2fb56a0fafd60e1b43e59e3454fd953be8f624ce8eca9aca9adf24e6e52ac4e6dd26d7ff163969f4a7cf0dc9783bbf020d0b237979bfbb8a0617d61a269d629bbf160d681b4b52b5aaf076c2b8e4facf3af18ec04ecd8737d1fe1431e4fc2d3c6886bd577f5ab6a08282c2e10acfcf36118c5844a8bb7506b020f3e539cffc11c2afe499d35fd6562a591058d755299c0057f659c85bef65d94c1f58adaa93e299cd1fdc9618e8dd3ce4f5293ce40325018ce41cc3d6d610ea9ccce0d9211c73de4dd767dea1dd6fdc55d5901c1f531266d740d66728598e9ff925c318251a1b9de66c2746fd6d3b5c855cc8573aad7a8046d08f1346a59b14551b94125dd65be85a3cadf4ebcec1dee41f341af750c15b2b9a7257459267d04a1982ef9321e1082fee7a324a0a6ccfb5120758cd98f864c9a10ff349ca63e15620948f176ee54cc0853ae07125b4e7f93e337b01be307c7bb545f0a4376df5abcc66365c7a984f6499bcd07728baf50738417b93b9da7fe649d46fe3a1c9e82fcb6239baff8b39ca00168d6364a2a4eae8c534d7ff123ed7732dbdfc043151f497c71629288c60c9530061084b2b516a5045606fa84a7c9b42d2871d6e50b790f9933faaf580cf810da003f86a365808aaef0cddbee38329e9083b2bf671c2bfce8213651244d4bad37d25bc847cfab8c50ee002debd10f82139840054089e08a8488b9535a0846480acab6d66b35976544750899d0c6f7abeb2f88b349af4d8c6d50f1f6ae5aed86f1bb529f003c409c8081c3bd771edbfcff1ddc3d42ddc082ecd7317bea6750db78f8a65e153c09222d9e727d10a278fe58a3c0608383afff4cdc0e03edafd14cf68f54b3c4602ad210497ff163128fc033fa6f61d3323fe0235d68fd1662749958b9be9e1d4201eed94c82d0594c45ec550fc51366f79a5bc1c75a4bc6cf3b0c60ee04ad6a8eae0ccdec91d2ce7fcd1c6d00ed7211e63df5211abd46e25a3e78a220f95c5dbdc121d1350615ebf5afaa6cb66eeb726f2e73d398fffe9ce34138795a1d38bda05eccfcefde0cfdac5d6ffd73dd273e8be3d757047bb65f94c3c547967b0a5fa803eab737549b847f94638b08f056d6844b09cf292c490ef54c26121a47064bc4ef9973b9a71e8bfca823147f446388b712e436b52a198e81cdfd4de2f137296b6d17ed8b51cf850cc6ac9a6cf99026f784db95007abc58a27a911e31bce95fd5c3b6e8dbec38b39c17bdbbe19fbe7c1d207de59d153ef9dc9e017d3d5ddd4142e9c09243bedf633c0fe2ece8ccabad282d56cd4a0e893211660d7a4dd83145d1b971a6ddf53ea922ea0ee9b269272d3b4e6772ebd8c8804ebf6c238f8fd3b3c858f642e568c5d0da7ef8a29b8ec0ed6acea82c8b8c57d3cb0f6fb393af486c56520a4e4832ca9ed1433aff5ea37cd85e037c78	msdcsc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}\ = cc083485e8e061afba53de8f78acdc70fee023a39f4ffcf32390bf7edce203879f6bbcf75fa40384d73b34df16fc349da83d0d9d0dfd11e2bdeee2b32fd0b37ce86035e699ab86506bce574d7b92e776b454e905317551a50d766e5ab23829606ea9f22927291b517f09638d972d4451164534a5a8362a2a2e36f3da2108d41a14c2867965a2c9a0aa838e1f4dc311f70954b14819f2c5e87a2d2051740e56b2e5d19bf587e6248594098b7548a6124ac616d534c56846c81a0900f5e19aa9f98a2671d411b7f9e41e29fd956146659b65bf155cfac226572a8416488472f52955adb5f2d6e84a2d966dcb6db751e43ee7a26bd72f044c848c4bf1575efbc2983f7a23e05f78439ebf7d5c5d003dfb611fb603243706ab740f2413b6071a9b46f89b207fb023ae5f4dc3111039fcd9a386c79a54017889e056c8ca0d9071c11aeef80c5fae3cb21e97820b5e4fbcb39dd0bd841ecbfc2821716de1324ad0ae37931b8707c4cb976f0b13b7cf6453ba37a7db9b47c0cb994f05f3b92862f6c69bcbb80f1893c4c0191a79be21e3bd771deb41cf922c3090dec13d3e5d5d7d019e6dfc91e3fadf60fccae2f6f11b9287fed45d35be56a2044786fb04a0ea9d6f3d73e167321b16bf0423da0787c4a484f85b6547556bb5f7ea5bce87cde48eb40ce54c3a6c676c3b2f67538bc737db2b00f06ae42fab9348086e2e126cc11329c70d14113a8126c29a163e846296587b8067d12bf1b7de2cc6902f48642cd8c5b910ad3b7b5aab83b7c4ee66fdca1adbb25cb0cbc126e14b6003b159fc446e97303e35ddecbd0de20d312d528d002d5211800522b5162504459a790065fa412775f4169a8a793159213d259dd90146e9d41277ffdba33888e26db9519d0502cac8ee09b3092731cbe948aa14ee0873945ff98326c0a4e8f53156918a71899df2c29691053dfa5d1ebec22291008118428456184478185a84465b2b876fabf3b0dfed7c8d1fee033347a70484a6a8f50b1a97c074e9d8aa82c8b71554850849cab5d7d6fbca60cf2ef372a858c9ba2e21cc0591058a46f6545bfab8a65e9b4207d86b87d7747bea67698bae304c200e1e7282d8e9c7524bce4f138c78f01c93be085d74c156fe74e22a594e398d6551b94121fd49deb57ce62294160574a9d696f48427278b9b77789ba2f8a0a7dd6bbecf228c986ebcac9f9103497711eb052fb5736a17afbb9318b8ff2063d217010b09cf31ecd5924a7fd063030fe7b3db2f40f31f58c37c00a234362414d80a4270f8685e96c24529f50d95d1c67ddb1d47fdfb61e7f5341ae50665d4594445e6f535652965c9954d060d1a0d3e91a27ec7a304a79644bbc8a755e4baa59e354395df7abca65d6bc137521bbfc763b467a834355699fa86e65b350755fb49204d3c511c0d7d9121f1952e76acaa6c6fb033a1178dcb6e8833576f7bd367c71b04c776345adb8047f32be717e4bb9727cb3b50e078e8dcb1fc6a61b0419bedc0ed9e4ec31308f7ac14933a8720e4c8f76a2b2eb7f2ab6e70cc2c4cf3ac2f4df34d98cd41cd9d72421fc8c3ec100d32add8d2477fcbe30808ea28b152ed462ecaac6fb073d397800b384fa4d3f847198bb98fa5ecca91480956f1ca1ee90236586a382ea4ec15720918f1c0e6279a3b7927599b7d381d5abd405e8dc20df60deb516f0133b527159b493fb2e32e702c621066843468ea54f1fadddfbe3c5da2814782a4a8d42fb79314b0b696ab3bf758948479c5e146a2a487a5cbb950e678eb9c37fddbe180c28afe51e33df71d94810901b5c1a626aafb715f26031a4086522ac62e944cf9cc22cc7f4f232c4fcc9353f8cf644ccaadd671c555b90666648af671e42d4bd130fed69c4b43306fe21361bfd95c06fe24e3e4e7b9649a04fe185d864125a9d61274c016f73a94a0c432351ee53cc59eba3c21e25947bd3b1e5f3c835ef0039ef73d549d3bbe275d5b3dff1d1c813e322216a8c456f97ae5d886bb24a0eade4f835300b7901bcf7f2ca38ce093828737049be6b805a679156576a9aa2a0f306c5ad0f839db2147595b05ff899c327d169e34bca6630beff04c18d2c6496b8a17680b52f0fedaddc141597501e56ee69225cf658c49ed96cd0472eae0091b6d3f3123a950154235d02574b9685dac8153aef7aceb6de80e5452f6c02a1316cf7bcc27507b0e67f2fb56a0fafd60e1b43e59e3454fd953be8f624ce8eca9aca9adf24e6e52ac4e6dd26d7ff163969f4a7cf0dc9783bbf020d0b237979bfbb8a0617d61a269d629bbf160d681b4b52b5aaf076c2b8e4facf3af18ec04ecd8737d1fe1431e4fc2d3c6886bd577f5ab6a08282c2e10acfcf36118c5844a8bb7506b020f3e539cffc11c2afe499d35fd6562a591058d755299c0057f659c85bef65d94c1f58adaa93e299cd1fdc9618e8dd3ce4f5293ce40325018ce41cc3d6d610ea9ccce0d9211c73de4dd767dea1dd6fdc55d5901c1f531266d740d66728598e9ff925c318251a1b9de66c2746fd6d3b5c855cc8573aad7a8046d08f1346a59b14551b94125dd65be85a3cadf4ebcec1dee41f341af750c15b2b9a7257459267d04a1982ef9321e1082fee7a324a0a6ccfb5120758cd98f864c9a10ff349ca63e15620948f176ee54cc0853ae07125b4e7f93e337b01be307c7bb545f0a4376df5abcc66365c7a984f6499bcd07728baf50738417b93b9da7fe649d46fe3a1c9e82fcb6239baff8b39ca00168d6364a2a4eae8c534d7ff123ed7732dbdfc043151f497c71629288c60c9530061084b2b516a5045606fa84a7c9b42d2871d6e50b790f9933faaf580cf810da003f86a365808aaef0cddbee38329e9083b2bf671c2bfce8213651244d4bad37d25bc847cfab8c50ee002debd10f82139840054089e08a8488b9535a0846480acab6d66b35976544750899d0c6f7abeb2f88b349af4d8c6d50f1f6ae5aed86f1bb529f003c409c8081c3bd771edbfcff1ddc3d42ddc082ecd7317bea6750db78f8a65e153c09222d9e727d10a278fe58a3c0608383afff4cdc0e03edafd14cf68f54b3c4602ad210497ff163128fc033fa6f61d3323fe0235d68fd1662749958b9be9e1d4201eed94c82d0594c45ec550fc51366f79a5bc1c75a4bc6cf3b0c60ee04ad6a8eae0ccdec91d2ce7fcd1c6d00ed7211e63df5211abd46e25a3e78a220f95c5dbdc121d1350615ebf5afaa6cb66eeb726f2e73d398fffe9ce34138795a1d38bda05eccfcefde0cfdac5d6ffd73dd273e8be3d757047bb65f94c3c547967b0a5fa803eab737549b847f94638b08f056d6844b09cf292c490ef54c26121a47064bc4ef9973b9a71e8bfca823147f446388b712e436b52a198e81cdfd4de2f137296b6d17ed8b51cf850cc6ac9a6cf99026f784db95007abc58a27a911e31bce95fd5c3b6e8dbec38b39c17bdbbe19fbe7c1d207de59d153ef9dc9e017d3d5ddd4142e9c09243bedf633c0fe2ece8ccabad282d56cd4a0e893211660d7a4dd83145d1b971a6ddf53ea922ea0ee9b269272d3b4e6772ebd8c8804ebf6c238f8fd3b3c858f642e568c5d0da7ef8a29b8ec0ed6acea82c8b8c57d3cb0f6fb393af486c56520a4e4832ca9ed1433aff5ea37cd85e037c78	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}\ = 00732a07e8e061afba53de8f78acdc70fee023a39f4ffcf32390bf7edce203879f6bbcf75fa40384d73b34df16fc349da83d0d9d0dfd11e2bdeee2b32fd0b37ce86035e699ab86506bce574d7b92e776b454e905317551a50d766e5ab23829606ea9f22927291b517f09638d972d4451164534a5a8362a2a2e36f3da2108d41a14c2867965a2c9a0aa838e1f4dc311f70954b14819f2c5e87a2d2051740e56b2e0d19bf587e6248594098b7548a6124ac616d534c56846c81a0900f5e19aa9f98a2671d411b7f9e41e29fd956146659b65bf155cfac226572a8416488472f52955adb5f2d6e84a2d966dcb6db751e43ee7a26bd72f044c848c4bf1575efbc2983f7a23e05f78439ebf7d5c5d003dfb611fb603243706ab740f2413b6071a9b46f89b207fb023ae5f4dc3111039fcd9a386c79a54017889e056c8ca0d9071c11aeef80c5fae3cb21e97820b5e4fbcb39dd0bd841ecbfc2821716de1324ad0ae37931b8707c4cb976f0b13b7cf6453ba37a7db9b47c0cb994f05f3b92862f6c69bcbb80f1893c4c0191a79be21e3bd771deb41cf922c3090dec13d3e5d5d7d019e6dfc91e3fadf60fccae2f6f11b9287fed45d35be56a2044786fb04a0ea9d6f3d73e167321b16bf0423da0787c4a484f85b6547556bb5f7ea5bce87cde48eb40ce54c3a6c676c3b2f67538bc737db2b00f06ae42fab9348086e2e126cc11329c70d14113a8126c29a163e846296587b8067d12bf1b70028a3902f48642cd8c5b910ad3b7b5aab83b7c4ee66fdca1adbb25cb0cbc126e14b6003b159fc446e97303e35ddecbd0de20d312d528d002d5211800522b5162504459a790065fa412775f4169a8a793159213d259dd90146e9d41277ffdba33888e26db9519d0502cac8ee09b3092731cbe948aa14ee0873945ff98326c0a4e8f53156918a71899df2c29691053dfa5d1ebec22291008118428456184478185a84465b2b876fabf3b0dfed7c8d1fee033347a70484a6a8f50b1a97c074e9d8aa82c8b71554850849cab5d7d6fbca60cf2ef372a858c9ba2e21cc0591058a46f6545bfab8a65e9b4207d86b87d7747bea67698bae304c200e1e7282d8e9c7524bce4f138c78f01c93be085d74c156fe74e22a594e398d6551b94121fd49deb57ce62294160574a9d696f48427278b9b77789ba2f8a0a7dd6bbecf228c986ebcac9f9103497711eb052fb5736a17afbb9318b8ff2063d217010b09cf31ecd5924a7fd063030fe7b3db2f40f31f58c37c00a234362414d80a4270f8685e96c24529f50d95d1c67ddb1d47fdfb61e7f5341ae50665d4594445e6f535652965c9954d060d1a0d3e91a27ec7a304a79644bbc8a755e4baa59e354395df7abca65d6bc137521bbfc763b467a834355699fa86e65b350755fb49204d3c511c0d7d9121f1952e76acaa6c6fb033a1178dcb6e8833576f7bd367c71b04c776345adb8047f32be717e4bb9727cb3b50e078e8dcb1fc6a61b0419bedc0ed9e4ec31308f7ac14933a8720e4c8f76a2b2eb7f2ab6e70cc2c4cf3ac2f4df34d98cd41cd9d72421fc8c3ec100d32add8d2477fcbe30808ea28b152ed462ecaac6fb073d397800b384fa4d3f847198bb98fa5ecca91480956f1ca1ee90236586a382ea4ec15720918f1c0e6279a3b7927599b7d381d5abd405e8dc20df60deb516f0133b527159b493fb2e32e702c621066843468ea54f1fadddfbe3c5da2814782a4a8d42fb79314b0b696ab3bf758948479c5e146a2a487a5cbb950e678eb9c37fddbe180c28afe51e33df71d94810901b5c1a626aafb715f26031a4086522ac62e944cf9cc22cc7f4f232c4fcc9353f8cf644ccaadd671c555b90666648af671e42d4bd130fed69c4b43306fe21361bfd95c06fe24e3e4e7b9649a04fe185d864125a9d61274c016f73a94a0c432351ee53cc59eba3c21e25947bd3b1e5f3c835ef0039ef73d549d3bbe275d5b3dff1d1c813e322216a8c456f97ae5d886bb24a0eade4f835300b7901bcf7f2ca38ce093828737049be6b805a679156576a9aa2a0f306c5ad0f839db2147595b05ff899c327d169e34bca6630beff04c18d2c6496b8a17680b52f0fedaddc141597501e56ee69225cf658c49ed96cd0472eae0091b6d3f3123a950154235d02574b9685dac8153aef7aceb6de80e5452f6c02a1316cf7bcc27507b0e67f2fb56a0fafd60e1b43e59e3454fd953be8f624ce8eca9aca9adf24e6e52ac4e6dd26d7ff163969f4a7cf0dc9783bbf020d0b237979bfbb8a0617d61a269d629bbf160d681b4b52b5aaf076c2b8e4facf3af18ec04ecd8737d1fe1431e4fc2d3c6886bd577f5ab6a08282c2e10acfcf36118c5844a8bb7506b020f3e539cffc11c2afe499d35fd6562a591058d755299c0057f659c85bef65d94c1f58adaa93e299cd1fdc9618e8dd3ce4f5293ce40325018ce41cc3d6d610ea9ccce0d9211c73de4dd767dea1dd6fdc55d5901c1f531266d740d66728598e9ff925c318251a1b9de66c2746fd6d3b5c855cc8573aad7a8046d08f1346a59b14551b94125dd65be85a3cadf4ebcec1dee41f341af750c15b2b9a7257459267d04a1982ef9321e1082fee7a324a0a6ccfb5120758cd98f864c9a10ff349ca63e15620948f176ee54cc0853ae07125b4e7f93e337b01be307c7bb545f0a4376df5abcc66365c7a984f6499bcd07728baf50738417b93b9da7fe649d46fe3a1c9e82fcb6239baff8b39ca00168d6364a2a4eae8c534d7ff123ed7732dbdfc043151f497c71629288c60c9530061084b2b516a5045606fa84a7c9b42d2871d6e50b790f9933faaf580cf810da003f86a365808aaef0cddbee38329e9083b2bf671c2bfce8213651244d4bad37d25bc847cfab8c50ee002debd10f82139840054089e08a8488b9535a0846480acab6d66b35976544750899d0c6f7abeb2f88b349af4d8c6d50f1f6ae5aed86f1bb529f003c409c8081c3bd771edbfcff1ddc3d42ddc082ecd7317bea6750db78f8a65e153c09222d9e727d10a278fe58a3c0608383afff4cdc0e03edafd14cf68f54b3c4602ad210497ff163128fc033fa6f61d3323fe0235d68fd1662749958b9be9e1d4201eed94c82d0594c45ec550fc51366f79a5bc1c75a4bc6cf3b0c60ee04ad6a8eae0ccdec91d2ce7fcd1c6d00ed7211e63df5211abd46e25a3e78a220f95c5dbdc121d1350615ebf5afaa6cb66eeb726f2e73d398fffe9ce34138795a1d38bda05eccfcefde0cfdac5d6ffd73dd273e8be3d757047bb65f94c3c547967b0a5fa803eab737549b847f94638b08f056d6844b09cf292c490ef54c26121a47064bc4ef9973b9a71e8bfca823147f446388b712e436b52a198e81cdfd4de2f137296b6d17ed8b51cf850cc6ac9a6cf99026f784db95007abc58a27a911e31bce95fd5c3b6e8dbec38b39c17bdbbe19fbe7c1d207de59d153ef9dc9e017d3d5ddd4142e9c09243bedf633c0fe2ece8ccabad282d56cd4a0e893211660d7a4dd83145d1b971a6ddf53ea922ea0ee9b269272d3b4e6772ebd8c8804ebf6c238f8fd3b3c858f642e568c5d0da7ef8a29b8ec0ed6acea82c8b8c57d3cb0f6fb393af486c56520a4e4832ca9ed1433aff5ea37cd85e037c78	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}	msdcsc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}\ = b73dbfdbe8e061afba53de8f78acdc70fee023a39f4ffcf32390bf7edce203879f6bbcf75fa40384d73b34df16fc349da83d0d9d0dfd11e2bdeee2b32fd0b37ce86035e699ab86506bce574d7b92e776b454e905317551a50d766e5ab23829606ea9f22927291b517f09638d972d4451164534a5a8362a2a2e36f3da2108d41a14c2867965a2c9a0aa838e1f4dc311f70954b14819f2c5e87a2d2051740e56b2e0d19bf587e6248594098b7548a6124ac616d534c56846c81a0900f5e19aa9f98a2671d411b7f9e41e29fd956146659b65bf155cfac226572a8416488472f52955adb5f2d6e84a2d966dcb6db751e43ee7a26bd72f044c848c4bf1575efbc2983f7a23e05f78439ebf7d5c5d003dfb611fb603243706ab740f2413b6071a9b46f89b207fb023ae5f4dc3111039fcd9a386c79a54017889e056c8ca0d9071c11aeef80c5fae3cb21e97820b5e4fbcb39dd0bd841ecbfc2821716de1324ad0ae37931b8707c4cb976f0b13b7cf6453ba37a7db9b47c0cb994f05f3b92862f6c69bcbb80f1893c4c0191a79be21e3bd771deb41cf922c3090dec13d3e5d5d7d019e6dfc91e3fadf60fccae2f6f11b9287fed45d35be56a2044786fb04a0ea9d6f3d73e167321b16bf0423da0787c4a484f85b6547556bb5f7ea5bce87cde48eb40ce54c3a6c676c3b2f67538bc737db2b00f06ae42fab9348086e2e126cc11329c70d14113a8126c29a163e846296587b8067d12bf1b7704ea5902f48642cd8c5b910ad3b7b5aab83b7c4ee66fdca1adbb25cb0cbc126e14b6003b159fc446e97303e35ddecbd0de20d312d528d002d5211800522b5162504459a790065fa412775f4169a8a793159213d259dd90146e9d41277ffdba33888e26db9519d0502cac8ee09b3092731cbe948aa14ee0873945ff98326c0a4e8f53156918a71899df2c29691053dfa5d1ebec22291008118428456184478185a84465b2b876fabf3b0dfed7c8d1fee033347a70484a6a8f50b1a97c074e9d8aa82c8b71554850849cab5d7d6fbca60cf2ef372a858c9ba2e21cc0591058a46f6545bfab8a65e9b4207d86b87d7747bea67698bae304c200e1e7282d8e9c7524bce4f138c78f01c93be085d74c156fe74e22a594e398d6551b94121fd49deb57ce62294160574a9d696f48427278b9b77789ba2f8a0a7dd6bbecf228c986ebcac9f9103497711eb052fb5736a17afbb9318b8ff2063d217010b09cf31ecd5924a7fd063030fe7b3db2f40f31f58c37c00a234362414d80a4270f8685e96c24529f50d95d1c67ddb1d47fdfb61e7f5341ae50665d4594445e6f535652965c9954d060d1a0d3e91a27ec7a304a79644bbc8a755e4baa59e354395df7abca65d6bc137521bbfc763b467a834355699fa86e65b350755fb49204d3c511c0d7d9121f1952e76acaa6c6fb033a1178dcb6e8833576f7bd367c71b04c776345adb8047f32be717e4bb9727cb3b50e078e8dcb1fc6a61b0419bedc0ed9e4ec31308f7ac14933a8720e4c8f76a2b2eb7f2ab6e70cc2c4cf3ac2f4df34d98cd41cd9d72421fc8c3ec100d32add8d2477fcbe30808ea28b152ed462ecaac6fb073d397800b384fa4d3f847198bb98fa5ecca91480956f1ca1ee90236586a382ea4ec15720918f1c0e6279a3b7927599b7d381d5abd405e8dc20df60deb516f0133b527159b493fb2e32e702c621066843468ea54f1fadddfbe3c5da2814782a4a8d42fb79314b0b696ab3bf758948479c5e146a2a487a5cbb950e678eb9c37fddbe180c28afe51e33df71d94810901b5c1a626aafb715f26031a4086522ac62e944cf9cc22cc7f4f232c4fcc9353f8cf644ccaadd671c555b90666648af671e42d4bd130fed69c4b43306fe21361bfd95c06fe24e3e4e7b9649a04fe185d864125a9d61274c016f73a94a0c432351ee53cc59eba3c21e25947bd3b1e5f3c835ef0039ef73d549d3bbe275d5b3dff1d1c813e322216a8c456f97ae5d886bb24a0eade4f835300b7901bcf7f2ca38ce093828737049be6b805a679156576a9aa2a0f306c5ad0f839db2147595b05ff899c327d169e34bca6630beff04c18d2c6496b8a17680b52f0fedaddc141597501e56ee69225cf658c49ed96cd0472eae0091b6d3f3123a950154235d02574b9685dac8153aef7aceb6de80e5452f6c02a1316cf7bcc27507b0e67f2fb56a0fafd60e1b43e59e3454fd953be8f624ce8eca9aca9adf24e6e52ac4e6dd26d7ff163969f4a7cf0dc9783bbf020d0b237979bfbb8a0617d61a269d629bbf160d681b4b52b5aaf076c2b8e4facf3af18ec04ecd8737d1fe1431e4fc2d3c6886bd577f5ab6a08282c2e10acfcf36118c5844a8bb7506b020f3e539cffc11c2afe499d35fd6562a591058d755299c0057f659c85bef65d94c1f58adaa93e299cd1fdc9618e8dd3ce4f5293ce40325018ce41cc3d6d610ea9ccce0d9211c73de4dd767dea1dd6fdc55d5901c1f531266d740d66728598e9ff925c318251a1b9de66c2746fd6d3b5c855cc8573aad7a8046d08f1346a59b14551b94125dd65be85a3cadf4ebcec1dee41f341af750c15b2b9a7257459267d04a1982ef9321e1082fee7a324a0a6ccfb5120758cd98f864c9a10ff349ca63e15620948f176ee54cc0853ae07125b4e7f93e337b01be307c7bb545f0a4376df5abcc66365c7a984f6499bcd07728baf50738417b93b9da7fe649d46fe3a1c9e82fcb6239baff8b39ca00168d6364a2a4eae8c534d7ff123ed7732dbdfc043151f497c71629288c60c9530061084b2b516a5045606fa84a7c9b42d2871d6e50b790f9933faaf580cf810da003f86a365808aaef0cddbee38329e9083b2bf671c2bfce8213651244d4bad37d25bc847cfab8c50ee002debd10f82139840054089e08a8488b9535a0846480acab6d66b35976544750899d0c6f7abeb2f88b349af4d8c6d50f1f6ae5aed86f1bb529f003c409c8081c3bd771edbfcff1ddc3d42ddc082ecd7317bea6750db78f8a65e153c09222d9e727d10a278fe58a3c0608383afff4cdc0e03edafd14cf68f54b3c4602ad210497ff163128fc033fa6f61d3323fe0235d68fd1662749958b9be9e1d4201eed94c82d0594c45ec550fc51366f79a5bc1c75a4bc6cf3b0c60ee04ad6a8eae0ccdec91d2ce7fcd1c6d00ed7211e63df5211abd46e25a3e78a220f95c5dbdc121d1350615ebf5afaa6cb66eeb726f2e73d398fffe9ce34138795a1d38bda05eccfcefde0cfdac5d6ffd73dd273e8be3d757047bb65f94c3c547967b0a5fa803eab737549b847f94638b08f056d6844b09cf292c490ef54c26121a47064bc4ef9973b9a71e8bfca823147f446388b712e436b52a198e81cdfd4de2f137296b6d17ed8b51cf850cc6ac9a6cf99026f784db95007abc58a27a911e31bce95fd5c3b6e8dbec38b39c17bdbbe19fbe7c1d207de59d153ef9dc9e017d3d5ddd4142e9c09243bedf633c0fe2ece8ccabad282d56cd4a0e893211660d7a4dd83145d1b971a6ddf53ea922ea0ee9b269272d3b4e6772ebd8c8804ebf6c238f8fd3b3c858f642e568c5d0da7ef8a29b8ec0ed6acea82c8b8c57d3cb0f6fb393af486c56520a4e4832ca9ed1433aff5ea37cd85e037c78	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{4AF01F26-6741BA93-03916DA9-05F6072C}\ = 8079b229e8e061afba53de8f78acdc70fee023a39f4ffcf32390bf7edce203879f6bbcf75fa40384d73b34df16fc349da83d0d9d0dfd11e2bdeee2b32fd0b37ce86035e699ab86506bce574d7b92e776b454e905317551a50d766e5ab23829606ea9f22927291b517f09638d972d4451164534a5a8362a2a2e36f3da2108d41a14c2867965a2c9a0aa838e1f4dc311f70954b14819f2c5e87a2d2051740e56b2e7d19bf587e6248594098b7548a6124ac616d534c56846c81a0900f5e19aa9f98a2671d411b7f9e41e29fd956146659b65bf155cfac226572a8416488472f52955adb5f2d6e84a2d966dcb6db751e43ee7a26bd72f044c848c4bf1575efbc2983f7a23e05f78439ebf7d5c5d003dfb611fb603243706ab740f2413b6071a9b46f89b207fb023ae5f4dc3111039fcd9a386c79a54017889e056c8ca0d9071c11aeef80c5fae3cb21e97820b5e4fbcb39dd0bd841ecbfc2821716de1324ad0ae37931b8707c4cb976f0b13b7cf6453ba37a7db9b47c0cb994f05f3b92862f6c69bcbb80f1893c4c0191a79be21e3bd771deb41cf922c3090dec13d3e5d5d7d019e6dfc91e3fadf60fccae2f6f11b9287fed45d35be56a2044786fb04a0ea9d6f3d73e167321b16bf0423da0787c4a484f85b6547556bb5f7ea5bce87cde48eb40ce54c3a6c676c3b2f67538bc737db2b00f06ae42fab9348086e2e126cc11329c70d14113a8126c29a163e846296587b8067d12bf1b70028a3902f48642cd8c5b910ad3b7b5aab83b7c4ee66fdca1adbb25cb0cbc126e14b6003b159fc446e97303e35ddecbd0de20d312d528d002d5211800522b5162504459a790065fa412775f4169a8a793159213d259dd90146e9d41277ffdba33888e26db9519d0502cac8ee09b3092731cbe948aa14ee0873945ff98326c0a4e8f53156918a71899df2c29691053dfa5d1ebec22291008118428456184478185a84465b2b876fabf3b0dfed7c8d1fee033347a70484a6a8f50b1a97c074e9d8aa82c8b71554850849cab5d7d6fbca60cf2ef372a858c9ba2e21cc0591058a46f6545bfab8a65e9b4207d86b87d7747bea67698bae304c200e1e7282d8e9c7524bce4f138c78f01c93be085d74c156fe74e22a594e398d6551b94121fd49deb57ce62294160574a9d696f48427278b9b77789ba2f8a0a7dd6bbecf228c986ebcac9f9103497711eb052fb5736a17afbb9318b8ff2063d217010b09cf31ecd5924a7fd063030fe7b3db2f40f31f58c37c00a234362414d80a4270f8685e96c24529f50d95d1c67ddb1d47fdfb61e7f5341ae50665d4594445e6f535652965c9954d060d1a0d3e91a27ec7a304a79644bbc8a755e4baa59e354395df7abca65d6bc137521bbfc763b467a834355699fa86e65b350755fb49204d3c511c0d7d9121f1952e76acaa6c6fb033a1178dcb6e8833576f7bd367c71b04c776345adb8047f32be717e4bb9727cb3b50e078e8dcb1fc6a61b0419bedc0ed9e4ec31308f7ac14933a8720e4c8f76a2b2eb7f2ab6e70cc2c4cf3ac2f4df34d98cd41cd9d72421fc8c3ec100d32add8d2477fcbe30808ea28b152ed462ecaac6fb073d397800b384fa4d3f847198bb98fa5ecca91480956f1ca1ee90236586a382ea4ec15720918f1c0e6279a3b7927599b7d381d5abd405e8dc20df60deb516f0133b527159b493fb2e32e702c621066843468ea54f1fadddfbe3c5da2814782a4a8d42fb79314b0b696ab3bf758948479c5e146a2a487a5cbb950e678eb9c37fddbe180c28afe51e33df71d94810901b5c1a626aafb715f26031a4086522ac62e944cf9cc22cc7f4f232c4fcc9353f8cf644ccaadd671c555b90666648af671e42d4bd130fed69c4b43306fe21361bfd95c06fe24e3e4e7b9649a04fe185d864125a9d61274c016f73a94a0c432351ee53cc59eba3c21e25947bd3b1e5f3c835ef0039ef73d549d3bbe275d5b3dff1d1c813e322216a8c456f97ae5d886bb24a0eade4f835300b7901bcf7f2ca38ce093828737049be6b805a679156576a9aa2a0f306c5ad0f839db2147595b05ff899c327d169e34bca6630beff04c18d2c6496b8a17680b52f0fedaddc141597501e56ee69225cf658c49ed96cd0472eae0091b6d3f3123a950154235d02574b9685dac8153aef7aceb6de80e5452f6c02a1316cf7bcc27507b0e67f2fb56a0fafd60e1b43e59e3454fd953be8f624ce8eca9aca9adf24e6e52ac4e6dd26d7ff163969f4a7cf0dc9783bbf020d0b237979bfbb8a0617d61a269d629bbf160d681b4b52b5aaf076c2b8e4facf3af18ec04ecd8737d1fe1431e4fc2d3c6886bd577f5ab6a08282c2e10acfcf36118c5844a8bb7506b020f3e539cffc11c2afe499d35fd6562a591058d755299c0057f659c85bef65d94c1f58adaa93e299cd1fdc9618e8dd3ce4f5293ce40325018ce41cc3d6d610ea9ccce0d9211c73de4dd767dea1dd6fdc55d5901c1f531266d740d66728598e9ff925c318251a1b9de66c2746fd6d3b5c855cc8573aad7a8046d08f1346a59b14551b94125dd65be85a3cadf4ebcec1dee41f341af750c15b2b9a7257459267d04a1982ef9321e1082fee7a324a0a6ccfb5120758cd98f864c9a10ff349ca63e15620948f176ee54cc0853ae07125b4e7f93e337b01be307c7bb545f0a4376df5abcc66365c7a984f6499bcd07728baf50738417b93b9da7fe649d46fe3a1c9e82fcb6239baff8b39ca00168d6364a2a4eae8c534d7ff123ed7732dbdfc043151f497c71629288c60c9530061084b2b516a5045606fa84a7c9b42d2871d6e50b790f9933faaf580cf810da003f86a365808aaef0cddbee38329e9083b2bf671c2bfce8213651244d4bad37d25bc847cfab8c50ee002debd10f82139840054089e08a8488b9535a0846480acab6d66b35976544750899d0c6f7abeb2f88b349af4d8c6d50f1f6ae5aed86f1bb529f003c409c8081c3bd771edbfcff1ddc3d42ddc082ecd7317bea6750db78f8a65e153c09222d9e727d10a278fe58a3c0608383afff4cdc0e03edafd14cf68f54b3c4602ad210497ff163128fc033fa6f61d3323fe0235d68fd1662749958b9be9e1d4201eed94c82d0594c45ec550fc51366f79a5bc1c75a4bc6cf3b0c60ee04ad6a8eae0ccdec91d2ce7fcd1c6d00ed7211e63df5211abd46e25a3e78a220f95c5dbdc121d1350615ebf5afaa6cb66eeb726f2e73d398fffe9ce34138795a1d38bda05eccfcefde0cfdac5d6ffd73dd273e8be3d757047bb65f94c3c547967b0a5fa803eab737549b847f94638b08f056d6844b09cf292c490ef54c26121a47064bc4ef9973b9a71e8bfca823147f446388b712e436b52a198e81cdfd4de2f137296b6d17ed8b51cf850cc6ac9a6cf99026f784db95007abc58a27a911e31bce95fd5c3b6e8dbec38b39c17bdbbe19fbe7c1d207de59d153ef9dc9e017d3d5ddd4142e9c09243bedf633c0fe2ece8ccabad282d56cd4a0e893211660d7a4dd83145d1b971a6ddf53ea922ea0ee9b269272d3b4e6772ebd8c8804ebf6c238f8fd3b3c858f642e568c5d0da7ef8a29b8ec0ed6acea82c8b8c57d3cb0f6fb393af486c56520a4e4832ca9ed1433aff5ea37cd85e037c78	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeSecurityPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeTakeOwnershipPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeLoadDriverPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeSystemProfilePrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeSystemtimePrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeProfSingleProcessPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeIncBasePriorityPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeCreatePagefilePrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeBackupPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeRestorePrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeShutdownPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeDebugPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeSystemEnvironmentPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeChangeNotifyPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeRemoteShutdownPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeUndockPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeManageVolumePrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeImpersonatePrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeCreateGlobalPrivilege	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: 33	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: 34	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: 35	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: 36	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
Token: SeIncreaseQuotaPrivilege	4244	msdcsc.exe
Token: SeSecurityPrivilege	4244	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4244	msdcsc.exe
Token: SeLoadDriverPrivilege	4244	msdcsc.exe
Token: SeSystemProfilePrivilege	4244	msdcsc.exe
Token: SeSystemtimePrivilege	4244	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4244	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4244	msdcsc.exe
Token: SeCreatePagefilePrivilege	4244	msdcsc.exe
Token: SeBackupPrivilege	4244	msdcsc.exe
Token: SeRestorePrivilege	4244	msdcsc.exe
Token: SeShutdownPrivilege	4244	msdcsc.exe
Token: SeDebugPrivilege	4244	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4244	msdcsc.exe
Token: SeChangeNotifyPrivilege	4244	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4244	msdcsc.exe
Token: SeUndockPrivilege	4244	msdcsc.exe
Token: SeManageVolumePrivilege	4244	msdcsc.exe
Token: SeImpersonatePrivilege	4244	msdcsc.exe
Token: SeCreateGlobalPrivilege	4244	msdcsc.exe
Token: 33	4244	msdcsc.exe
Token: 34	4244	msdcsc.exe
Token: 35	4244	msdcsc.exe
Token: 36	4244	msdcsc.exe
Token: SeIncreaseQuotaPrivilege	5208	msdcsc.exe
Token: SeSecurityPrivilege	5208	msdcsc.exe
Token: SeTakeOwnershipPrivilege	5208	msdcsc.exe
Token: SeLoadDriverPrivilege	5208	msdcsc.exe
Token: SeSystemProfilePrivilege	5208	msdcsc.exe
Token: SeSystemtimePrivilege	5208	msdcsc.exe
Token: SeProfSingleProcessPrivilege	5208	msdcsc.exe
Token: SeIncBasePriorityPrivilege	5208	msdcsc.exe
Token: SeCreatePagefilePrivilege	5208	msdcsc.exe
Token: SeBackupPrivilege	5208	msdcsc.exe
Token: SeRestorePrivilege	5208	msdcsc.exe
Token: SeShutdownPrivilege	5208	msdcsc.exe
Token: SeDebugPrivilege	5208	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	5208	msdcsc.exe
Token: SeChangeNotifyPrivilege	5208	msdcsc.exe
Token: SeRemoteShutdownPrivilege	5208	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4244	msdcsc.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 4244	5496	cmd.exe	88
PID 5496 wrote to memory of 4244	5496	cmd.exe	88
PID 5496 wrote to memory of 4244	5496	cmd.exe	88
PID 3196 wrote to memory of 5208	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe	89
PID 3196 wrote to memory of 5208	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe	89
PID 3196 wrote to memory of 5208	3196	JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe	89
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90
PID 4244 wrote to memory of 3840	4244	msdcsc.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:5208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
752KB

MD5
95da3ebd31c00ef9c5186a0af6796440

SHA1
9e84a580f9af68bc1dd96431223f8d2ce87800d8

SHA256
08f61de703b5962e4339d1c768c0b8fe9591c655992cb68bd9e9176e85a8488d

SHA512
b0647d42c3f32363a7fe0b62298c9a1522fe8bc98be7c97da4b52f7a51bac1a7d32a458e1ddc474d8ed162f672eadaf277f4ed4a296540d672ae8dd47b1e95b6

Download Submit
C:\Windows\PCGWIN32.LI5

Filesize
2KB

MD5
5314701c9a8831f4607d9f7572131297

SHA1
11327be494df75d26c944118ecf0f5fca6ad7fc1

SHA256
292c799fccf61279bcbdfa2a30eddebb0f0573db5d76e5dd5dca6c38391dd992

SHA512
c3000c82d3a8fed8a76ff6e278d42f95a0d4bebc77a4b6985f82479b8afc34e7615d6aa6669a7b12920a00e7157081459a743e4045d6edfb306bcf8841561a1b

Download Submit
C:\Windows\PCGWIN32.LI5

Filesize
2KB

MD5
1ccd95cba2589665633205e35fa41bbf

SHA1
5e49f26dd88460aee569defd9021d33bce5179b2

SHA256
699ffa49894c675ae218886d3570108611c30a829993786641b65f71f29a3151

SHA512
ed2af428b1d0ec687dab31f4e64eb226f15711bbf3746fb2cc2959056ee3d4579ab855f45c989d856d3354879e817a0fbc42063ed691684206a85b7afe5d9c5e

Download Submit
C:\Windows\PCGWIN32.LI5

Filesize
2KB

MD5
86f689077f3656362167d47a7f5fa840

SHA1
dd802597f921a71d6ec65aa31a7948a14fd0222a

SHA256
1d2d6db8b30b18d40301d915cdf2c42e3195c97cec48fe7ebad8de06c4560c2b

SHA512
a04bce8768ca071fc0ec1492c1ad2c3552f0007957b3bdaa6dd9d381bcf8dfe7ca81a3caae22d11964a6b15bbe02645203438d82ea49dc186a82e8875b494eed

Download Submit
memory/3196-12-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/3196-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3196-58-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3840-53-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/4244-37-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4244-52-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/4244-59-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4244-62-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4244-64-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4244-66-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4244-68-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/5208-54-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/5208-56-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/5208-39-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads