cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6

Analysis

max time kernel
154s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
Size

78KB
MD5

b02a42a3dc16c2f7e971107c7aec01c3
SHA1

a12b83983647fb0ed5fb1303f7ff8cd5ded1e699
SHA256

cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6
SHA512

a840d0e51924ebceaf9411a1d519997cb7e1a8fb18d257fcd18202839d440adbc705a49b2c15af9004420d062ed794baf3c3f22a64c5271978971280335fc7ec
SSDEEP

1536:GN9KsMdRp+yAqR4ssWWLN/fcBLjD0IIR05LGBD1hvVL3bBKmo3STBs7:oKf3p+yAqRdy/fQwIhLGBDrvdbBVo3sa

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
948	snss.exe
468	snss.exe
980	snss.exe
336	snss.exe
1284	snss.exe
1320	snss.exe
1868	snss.exe
1004	snss.exe
968	snss.exe
1552	snss.exe
1984	snss.exe
2012	snss.exe
952	snss.exe
1948	snss.exe
544	snss.exe
520	snss.exe
2100	snss.exe
2160	snss.exe
2220	snss.exe
2280	snss.exe
2340	snss.exe
2400	snss.exe
2448	snss.exe
2492	snss.exe
2536	snss.exe
2600	snss.exe
2644	snss.exe
2692	snss.exe
2736	snss.exe
2788	snss.exe
2832	snss.exe
2880	snss.exe
2928	snss.exe
2976	snss.exe
3024	snss.exe
1208	snss.exe
2176	snss.exe
2348	snss.exe
2608	snss.exe
2748	snss.exe
2228	snss.exe
3080	snss.exe
3132	snss.exe
3180	snss.exe
3224	snss.exe
3272	snss.exe
3320	snss.exe
3368	snss.exe
3416	snss.exe
3464	snss.exe
3512	snss.exe
3560	snss.exe
3608	snss.exe
3656	snss.exe
3700	snss.exe
3748	snss.exe
3796	snss.exe
3844	snss.exe
3892	snss.exe
3940	snss.exe
3988	snss.exe
4036	snss.exe
4080	snss.exe
3288	snss.exe

Loads dropped DLL 64 IoCs

pid	Process
896	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
896	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
948	snss.exe
948	snss.exe
468	snss.exe
468	snss.exe
980	snss.exe
980	snss.exe
336	snss.exe
336	snss.exe
1284	snss.exe
1284	snss.exe
1320	snss.exe
1320	snss.exe
1868	snss.exe
1868	snss.exe
1004	snss.exe
1004	snss.exe
968	snss.exe
968	snss.exe
1552	snss.exe
1552	snss.exe
1984	snss.exe
1984	snss.exe
2012	snss.exe
2012	snss.exe
952	snss.exe
952	snss.exe
1948	snss.exe
1948	snss.exe
544	snss.exe
544	snss.exe
520	snss.exe
520	snss.exe
2100	snss.exe
2100	snss.exe
2160	snss.exe
2160	snss.exe
2220	snss.exe
2220	snss.exe
2280	snss.exe
2280	snss.exe
2340	snss.exe
2340	snss.exe
2400	snss.exe
2400	snss.exe
2448	snss.exe
2448	snss.exe
2492	snss.exe
2492	snss.exe
2536	snss.exe
2536	snss.exe
2600	snss.exe
2600	snss.exe
2644	snss.exe
2644	snss.exe
2692	snss.exe
2692	snss.exe
2736	snss.exe
2736	snss.exe
2788	snss.exe
2788	snss.exe
2832	snss.exe
2832	snss.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe"	snss.exe

Modifies WinLogon 2 TTPs 64 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Lock = "WLEvtLock"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\DllName = "snss.dll"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Shutdown = "WLEvtShutdown"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Shutdown = "WLEvtShutdown"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\DllName = "snss.dll"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StartScreenSaver = "WLEvtStartScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Lock = "WLEvtLock"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logon = "WLEvtLogon"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Unlock = "WLEvtUnlock"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logon = "WLEvtLogon"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Unlock = "WLEvtUnlock"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Unlock = "WLEvtUnlock"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logon = "WLEvtLogon"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Lock = "WLEvtLock"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StartScreenSaver = "WLEvtStartScreenSaver"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logon = "WLEvtLogon"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\DllName = "snss.dll"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StartScreenSaver = "WLEvtStartScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StartScreenSaver = "WLEvtStartScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Unlock = "WLEvtUnlock"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\DllName = "snss.dll"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup"	snss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StartScreenSaver = "WLEvtStartScreenSaver"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0"	snss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logon = "WLEvtLogon"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Unlock = "WLEvtUnlock"	snss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StartScreenSaver = "WLEvtStartScreenSaver"	snss.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File opened for modification	C:\Windows\SysWOW64\snss.dll	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.dll	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe
File created	C:\Windows\SysWOW64\snss.exe	snss.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 948	896	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe	28
PID 896 wrote to memory of 948	896	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe	28
PID 896 wrote to memory of 948	896	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe	28
PID 896 wrote to memory of 948	896	cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe	28
PID 948 wrote to memory of 468	948	snss.exe	29
PID 948 wrote to memory of 468	948	snss.exe	29
PID 948 wrote to memory of 468	948	snss.exe	29
PID 948 wrote to memory of 468	948	snss.exe	29
PID 468 wrote to memory of 980	468	snss.exe	30
PID 468 wrote to memory of 980	468	snss.exe	30
PID 468 wrote to memory of 980	468	snss.exe	30
PID 468 wrote to memory of 980	468	snss.exe	30
PID 980 wrote to memory of 336	980	snss.exe	31
PID 980 wrote to memory of 336	980	snss.exe	31
PID 980 wrote to memory of 336	980	snss.exe	31
PID 980 wrote to memory of 336	980	snss.exe	31
PID 336 wrote to memory of 1284	336	snss.exe	32
PID 336 wrote to memory of 1284	336	snss.exe	32
PID 336 wrote to memory of 1284	336	snss.exe	32
PID 336 wrote to memory of 1284	336	snss.exe	32
PID 1284 wrote to memory of 1320	1284	snss.exe	33
PID 1284 wrote to memory of 1320	1284	snss.exe	33
PID 1284 wrote to memory of 1320	1284	snss.exe	33
PID 1284 wrote to memory of 1320	1284	snss.exe	33
PID 1320 wrote to memory of 1868	1320	snss.exe	34
PID 1320 wrote to memory of 1868	1320	snss.exe	34
PID 1320 wrote to memory of 1868	1320	snss.exe	34
PID 1320 wrote to memory of 1868	1320	snss.exe	34
PID 1868 wrote to memory of 1004	1868	snss.exe	35
PID 1868 wrote to memory of 1004	1868	snss.exe	35
PID 1868 wrote to memory of 1004	1868	snss.exe	35
PID 1868 wrote to memory of 1004	1868	snss.exe	35
PID 1004 wrote to memory of 968	1004	snss.exe	36
PID 1004 wrote to memory of 968	1004	snss.exe	36
PID 1004 wrote to memory of 968	1004	snss.exe	36
PID 1004 wrote to memory of 968	1004	snss.exe	36
PID 968 wrote to memory of 1552	968	snss.exe	37
PID 968 wrote to memory of 1552	968	snss.exe	37
PID 968 wrote to memory of 1552	968	snss.exe	37
PID 968 wrote to memory of 1552	968	snss.exe	37
PID 1552 wrote to memory of 1984	1552	snss.exe	38
PID 1552 wrote to memory of 1984	1552	snss.exe	38
PID 1552 wrote to memory of 1984	1552	snss.exe	38
PID 1552 wrote to memory of 1984	1552	snss.exe	38
PID 1984 wrote to memory of 2012	1984	snss.exe	39
PID 1984 wrote to memory of 2012	1984	snss.exe	39
PID 1984 wrote to memory of 2012	1984	snss.exe	39
PID 1984 wrote to memory of 2012	1984	snss.exe	39
PID 2012 wrote to memory of 952	2012	snss.exe	40
PID 2012 wrote to memory of 952	2012	snss.exe	40
PID 2012 wrote to memory of 952	2012	snss.exe	40
PID 2012 wrote to memory of 952	2012	snss.exe	40
PID 952 wrote to memory of 1948	952	snss.exe	41
PID 952 wrote to memory of 1948	952	snss.exe	41
PID 952 wrote to memory of 1948	952	snss.exe	41
PID 952 wrote to memory of 1948	952	snss.exe	41
PID 1948 wrote to memory of 544	1948	snss.exe	42
PID 1948 wrote to memory of 544	1948	snss.exe	42
PID 1948 wrote to memory of 544	1948	snss.exe	42
PID 1948 wrote to memory of 544	1948	snss.exe	42
PID 544 wrote to memory of 520	544	snss.exe	43
PID 544 wrote to memory of 520	544	snss.exe	43
PID 544 wrote to memory of 520	544	snss.exe	43
PID 544 wrote to memory of 520	544	snss.exe	43

C:\Users\Admin\AppData\Local\Temp\cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
"C:\Users\Admin\AppData\Local\Temp\cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\snss.exe
  "C:\Windows\system32\snss.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\snss.exe
    "C:\Windows\system32\snss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\SysWOW64\snss.exe
      "C:\Windows\system32\snss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies WinLogon
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:336
      - C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies WinLogon
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:520
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2100
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:2160
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        
        PID:2220
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2280
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2340
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2400
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        
        PID:2448
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2492
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2536
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2600
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        
        PID:2692
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies WinLogon
        
        PID:2736
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2788
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2832
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        33⤵
        Executes dropped EXE
        
        PID:2880
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        34⤵
        Executes dropped EXE
        
        PID:2928
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        35⤵
        Executes dropped EXE
        
        PID:2976
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        36⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        37⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1208
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        38⤵
        Executes dropped EXE
        
        PID:2176
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        39⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        40⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        41⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        42⤵
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        43⤵
        Executes dropped EXE
        Modifies WinLogon
        
        PID:3080
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        44⤵
        Executes dropped EXE
        
        PID:3132
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        45⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3180
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        46⤵
        Executes dropped EXE
        Modifies WinLogon
        
        PID:3224
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        47⤵
        Executes dropped EXE
        Modifies WinLogon
        
        PID:3272
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        48⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        49⤵
        Executes dropped EXE
        
        PID:3368
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        50⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3416
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        51⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        52⤵
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        53⤵
        Executes dropped EXE
        
        PID:3560
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        54⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        55⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        56⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        57⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3796
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        59⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3844
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        60⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        61⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        62⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        63⤵
        Executes dropped EXE
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:4036
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        64⤵
        Executes dropped EXE
        
        PID:4080
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        65⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        66⤵
        Modifies WinLogon
        
        PID:3528
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        67⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        68⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        69⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        70⤵
        Adds Run key to start application
        
        PID:4144
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        71⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        72⤵
        Adds Run key to start application
        
        PID:4236
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        73⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        74⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        75⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        76⤵
        Adds Run key to start application
        
        PID:4408
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        77⤵
        Adds Run key to start application
        
        PID:4448
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        78⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        79⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        80⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        81⤵
        Drops file in System32 directory
        
        PID:4628
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        82⤵
        Drops file in System32 directory
        
        PID:4668
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        83⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        84⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        85⤵
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:4808
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        86⤵
        Modifies WinLogon
        
        PID:4848
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        87⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        88⤵
        Modifies WinLogon
        
        PID:4932
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        89⤵
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        90⤵
        Drops file in System32 directory
        
        PID:5020
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        91⤵
        Adds Run key to start application
        
        PID:5064
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        92⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        93⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        94⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:4820
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        95⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        96⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        97⤵
        Adds Run key to start application
        
        PID:5220
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        98⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        99⤵
        Adds Run key to start application
        
        PID:5308
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        100⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        101⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        102⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        103⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        104⤵
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        105⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        106⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        107⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        108⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:5704
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        109⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        110⤵
        Adds Run key to start application
        
        PID:5796
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        111⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        112⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        113⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        114⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        115⤵
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        116⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        117⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        118⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        119⤵
        Adds Run key to start application
        
        PID:5536
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        120⤵
        Modifies WinLogon
        
        PID:6064
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        121⤵
        Adds Run key to start application
        
        PID:6172
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        122⤵
        Modifies WinLogon
        
        PID:6216
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        123⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        124⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        125⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        126⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        127⤵
        Modifies WinLogon
        
        PID:6432
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        128⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        129⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        130⤵
        Adds Run key to start application
        
        PID:6568
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        131⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        132⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        133⤵
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        134⤵
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:6748
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        135⤵
        Modifies WinLogon
        
        PID:6792
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        136⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        137⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        138⤵
        Adds Run key to start application
        
        PID:6924
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        139⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        140⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        141⤵
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        142⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        143⤵
        Drops file in System32 directory
        
        PID:7144
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        144⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        145⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        146⤵
        Adds Run key to start application
        
        PID:7156
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        147⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        148⤵
        Modifies WinLogon
        
        PID:7248
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        149⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        150⤵
        Adds Run key to start application
        
        PID:7336
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        151⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        152⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        153⤵
        Modifies WinLogon
        
        PID:7468
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        154⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        155⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        156⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        157⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        158⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        159⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        160⤵
        Adds Run key to start application
        
        PID:7764
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        161⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        162⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        163⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        164⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        165⤵
        Modifies WinLogon
        
        PID:7984
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        166⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        167⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        168⤵
        Modifies WinLogon
        
        PID:8108
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        169⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        170⤵
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:7344
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        171⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        172⤵
        Modifies WinLogon
        
        PID:7860
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        173⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        174⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        175⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        176⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        177⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        178⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        179⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        180⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        181⤵
        Modifies WinLogon
        
        PID:8456
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        182⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        183⤵
        Modifies WinLogon
        
        PID:8544
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        184⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        185⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        186⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        187⤵
        Adds Run key to start application
        
        PID:8712
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        188⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        189⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:8796
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        190⤵
        Modifies WinLogon
        
        PID:8836
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        191⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        192⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        193⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        194⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        195⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        196⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        197⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        198⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        199⤵
        Modifies WinLogon
        
        PID:2208
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        200⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        201⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        202⤵
        Adds Run key to start application
        
        PID:8724
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        203⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        204⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        205⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        206⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        207⤵
        Drops file in System32 directory
        
        PID:9224
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        208⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        209⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        210⤵
        Adds Run key to start application
        
        PID:9364
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        211⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        212⤵
        Drops file in System32 directory
        
        PID:9452
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        213⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        214⤵
        Drops file in System32 directory
        
        PID:9544
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        215⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        216⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        217⤵
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:9672
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        218⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        219⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        220⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        221⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        222⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        223⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        224⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        225⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        226⤵
        Drops file in System32 directory
        
        PID:10072
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        227⤵
        Adds Run key to start application
        
        PID:10116
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        228⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        229⤵
        Drops file in System32 directory
        
        PID:10200
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        230⤵
        Adds Run key to start application
        
        PID:3360
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        231⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        232⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        233⤵
        Adds Run key to start application
        
        PID:3872
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        234⤵
        Modifies WinLogon
        
        PID:9908
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        235⤵
        Adds Run key to start application
        
        PID:10128
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        236⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        237⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        238⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        239⤵
        Adds Run key to start application
        
        PID:10292
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        240⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        241⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        242⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        243⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        244⤵
        Drops file in System32 directory
        
        PID:10520
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        245⤵
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:10564
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        246⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        247⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        248⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        249⤵
        Drops file in System32 directory
        
        PID:10744
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        250⤵
        Drops file in System32 directory
        
        PID:10784
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        251⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        252⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        253⤵
        Drops file in System32 directory
        
        PID:10916
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        254⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        255⤵
        Modifies WinLogon
        
        PID:11004
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        256⤵
        Modifies WinLogon
        
        PID:11048
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        257⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        258⤵
        Adds Run key to start application
        
        PID:11132
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        259⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:11176
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        260⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        261⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:10260
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        262⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        263⤵
        Adds Run key to start application
        
        PID:4700
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        264⤵
        Adds Run key to start application
        
        PID:10752
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        265⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:11016
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        266⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        267⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        268⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        269⤵
        Drops file in System32 directory
        
        PID:11312
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        270⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        271⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        272⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        273⤵
        Adds Run key to start application
        
        PID:11492
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        274⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        275⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        276⤵
        Adds Run key to start application
        
        PID:11628
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        277⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:11676
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        278⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        279⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        280⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:11808
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        281⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        282⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        283⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        284⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        285⤵
        Drops file in System32 directory
        
        PID:12024
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        286⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        287⤵
        Modifies WinLogon
        
        PID:12108
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        288⤵
        Drops file in System32 directory
        
        PID:12148
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        289⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:12192
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        290⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        291⤵
        Modifies WinLogon
        
        PID:12276
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        292⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        293⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        294⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        295⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        296⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        297⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        298⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        299⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        300⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        301⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        302⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        303⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        304⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        305⤵
        Adds Run key to start application
        
        PID:12380
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        306⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        307⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        308⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        309⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        310⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        311⤵
        
        PID:12648
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        312⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        313⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        314⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        315⤵
        Adds Run key to start application
        Modifies WinLogon
        
        PID:12816
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        316⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        317⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        318⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        319⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:12984
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        320⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        321⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        322⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        323⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        324⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        325⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        326⤵
        Drops file in System32 directory
        
        PID:13296
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        327⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        328⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        329⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        330⤵
        Drops file in System32 directory
        
        PID:4180
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        331⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        332⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        333⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        334⤵
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:4580
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        335⤵
        Modifies WinLogon
        
        PID:13176
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        336⤵
        Modifies WinLogon
        
        PID:7124
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        337⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        338⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        339⤵
        Drops file in System32 directory
        
        PID:7452
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        340⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        341⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        342⤵
        Adds Run key to start application
        
        PID:13328
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        343⤵
        
        PID:13372
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        344⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        345⤵
        Adds Run key to start application
        
        PID:13464
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        346⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        347⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        348⤵
        Adds Run key to start application
        
        PID:13592
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        349⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        350⤵
        Drops file in System32 directory
        
        PID:13676
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        351⤵
        Modifies WinLogon
        
        PID:13720
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        352⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:13760
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        353⤵
        
        PID:13804
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        354⤵
        
        PID:13844
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        355⤵
        Modifies WinLogon
        
        PID:13896
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        356⤵
        Adds Run key to start application
        
        PID:13940
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        357⤵
        Drops file in System32 directory
        
        PID:13984
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        358⤵
        Adds Run key to start application
        
        PID:14032
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        359⤵
        Modifies WinLogon
        Drops file in System32 directory
        
        PID:14076
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        360⤵
        
        PID:14120
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        361⤵
        
        PID:14164
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        362⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        363⤵
        
        PID:14252
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        364⤵
        
        PID:14296
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        365⤵
        Drops file in System32 directory
        
        PID:2436
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        366⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        367⤵
        
        PID:13516
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        368⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        369⤵
        Adds Run key to start application
        
        PID:2868
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        370⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        371⤵
        
        PID:13952
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        372⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\snss.exe
        
        "C:\Windows\system32\snss.exe"
        373⤵
        
        PID:8476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
C:\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
\Windows\SysWOW64\snss.exe

Filesize
16KB

MD5
ff0f33f278a3e5669d57bf351950859a

SHA1
bac136642eb643d8d52530e629bf3f6b86b14f9c

SHA256
561857e035868e07ca68e9a7f51211511dff91c406f605a193967d089319b105

SHA512
9380eff722ebf18ed4c55f27222b4d9f5b60835056e1ad65ef2bb0ed819f0d2fccc6111018b3b6eba88d1b3e2b87efedd3608f4f90a90674772d97f6f0915be5

Download Submit
memory/896-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads