9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219

Analysis

max time kernel
152s
max time network
107s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Size

163KB
MD5

d7698c2f7324e6b8ee0b43b66543b7db
SHA1

ace8f658a1c9e164911faaba6c2fccefea29e9b2
SHA256

9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219
SHA512

3667ccd392c8747cce3a119a077e1d75edbef8acb59b968391ab7f777b4cc241df8d2138f566bce22cbf431c709076336301bd74be9cf9364a4c66af108ca06a
SSDEEP

3072:EqhMPsVMYjUtQl78voutbzoI7h+aS1Gnf:EqhMPsFjU2F8voSbzo0naGf

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

csrss.exe services.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe winlogon.exe lsass.exe smss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	smss.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

services.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe winlogon.exe csrss.exescaa.exelsass.exe smss.exe csrss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe

Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

csrss.exescaa.exelsass.exe smss.exe csrss.exe services.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	scaa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

csrss.exescaa.exelsass.exe smss.exe csrss.exe services.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	scaa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

smss.exe csrss.exe services.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe winlogon.exe lsass.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

smss.exe csrss.exe services.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe winlogon.exe lsass.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 64 IoCs

Processes:

9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe csrss.execsrss.exe csrss.execsrss.exe scaa.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe smss.exelsass.exelsass.exelsass.exeservices.exeservices.exelsass.exe smss.exe services.exelsass.exe lsass.exe services.exe services.exe services.exe services.exeservices.exe winlogon.exewinlogon.exewinlogon.exewinlogon.execsrss.exewinlogon.exe winlogon.exe winlogon.exe winlogon.exe csrss.exe Paraysutki_VM_Communitycsrss.exesmss.exeParaysutki_VM_CommunityParaysutki_VM_Communitysmss.exe csrss.exe lsass.exesmss.exelsass.exe smss.exe lsass.exelsass.exe services.exeservices.exe services.exeservices.exe winlogon.exewinlogon.exe winlogon.exe

pid	process
1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
1452	csrss.exe
732	csrss.exe
888	csrss.exe
1684	csrss.exe
1556	scaa.exe
1632	smss.exe
288	smss.exe
1552	csrss.exe
1952	csrss.exe
1764	smss.exe
984	smss.exe
996	lsass.exe
944	lsass.exe
1460	csrss.exe
1124	csrss.exe
1700	smss.exe
760	smss.exe
1112	smss.exe
520	lsass.exe
272	lsass.exe
1060	lsass.exe
1592	services.exe
1816	services.exe
1880	lsass.exe
796	smss.exe
736	services.exe
2016	lsass.exe
1976	lsass.exe
1628	services.exe
1524	services.exe
1664	services.exe
1160	services.exe
1576	services.exe
2000	winlogon.exe
1912	winlogon.exe
1176	winlogon.exe
1340	winlogon.exe
1812	csrss.exe
544	winlogon.exe
1708	winlogon.exe
1096	winlogon.exe
1640	winlogon.exe
2040	csrss.exe
920	Paraysutki_VM_Community
1892	csrss.exe
1744	smss.exe
1764	Paraysutki_VM_Community
2004	Paraysutki_VM_Community
1460	smss.exe
996	csrss.exe
796	lsass.exe
1128	smss.exe
1736	lsass.exe
1952	smss.exe
752	lsass.exe
900	lsass.exe
1524	services.exe
2040	services.exe
1448	services.exe
1612	services.exe
1812	winlogon.exe
1704	winlogon.exe
1128	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

lsass.exe csrss.exe winlogon.exe services.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe smss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	csrss.exe

Loads dropped DLL 64 IoCs

Processes:

pid	process
536	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
536	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
732	csrss.exe
732	csrss.exe
732	csrss.exe
888	csrss.exe
888	csrss.exe
1684	csrss.exe
888	csrss.exe
888	csrss.exe
732	csrss.exe
732	csrss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
288	smss.exe
288	smss.exe
288	smss.exe
1552	csrss.exe
1552	csrss.exe
1952	csrss.exe
288	smss.exe
288	smss.exe
1764	smss.exe
1764	smss.exe
984	smss.exe
288	smss.exe
288	smss.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
944	lsass.exe
944	lsass.exe
944	lsass.exe
1460	csrss.exe
1460	csrss.exe
1124	csrss.exe
944	lsass.exe
944	lsass.exe
1700	smss.exe
1700	smss.exe
760	smss.exe
1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
732	csrss.exe
732	csrss.exe
944	lsass.exe
944	lsass.exe
288	smss.exe
1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
732	csrss.exe
1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
288	smss.exe
732	csrss.exe
1112	smss.exe
272	lsass.exe
272	lsass.exe
1112	smss.exe
944	lsass.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe csrss.exe services.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe lsass.exe scaa.exesmss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	smss.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

lsass.exe smss.exe csrss.exe services.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

scaa.exe

description	ioc	process
File opened (read-only)	\??\T:	scaa.exe
File opened (read-only)	\??\X:	scaa.exe
File opened (read-only)	\??\Y:	scaa.exe
File opened (read-only)	\??\N:	scaa.exe
File opened (read-only)	\??\Q:	scaa.exe
File opened (read-only)	\??\R:	scaa.exe
File opened (read-only)	\??\U:	scaa.exe
File opened (read-only)	\??\Z:	scaa.exe
File opened (read-only)	\??\J:	scaa.exe
File opened (read-only)	\??\K:	scaa.exe
File opened (read-only)	\??\S:	scaa.exe
File opened (read-only)	\??\I:	scaa.exe
File opened (read-only)	\??\L:	scaa.exe
File opened (read-only)	\??\V:	scaa.exe
File opened (read-only)	\??\W:	scaa.exe
File opened (read-only)	\??\B:	scaa.exe
File opened (read-only)	\??\G:	scaa.exe
File opened (read-only)	\??\H:	scaa.exe
File opened (read-only)	\??\O:	scaa.exe
File opened (read-only)	\??\P:	scaa.exe
File opened (read-only)	\??\E:	scaa.exe
File opened (read-only)	\??\F:	scaa.exe
File opened (read-only)	\??\M:	scaa.exe

Drops file in System32 directory 64 IoCs

Processes:

smss.exe smss.exelsass.exe services.exe winlogon.execsrss.exe csrss.exewinlogon.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe csrss.exelsass.execsrss.exewinlogon.exeParaysutki_VM_Communitylsass.exescaa.exeservices.exelsass.exelsass.exewinlogon.exesmss.exesmss.execsrss.exeParaysutki_VM_Communitysmss.exewinlogon.exelsass.exe

description	ioc	process
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	csrss.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	scaa.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	scaa.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	winlogon.exe

Drops file in Program Files directory 34 IoCs

Processes:

scaa.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	scaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	scaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	scaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	scaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	scaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe lsass.exe smss.exe csrss.exe services.exe winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	winlogon.exe

Modifies registry class 48 IoCs

Processes:

csrss.exescaa.exewinlogon.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe csrss.exe services.exe lsass.exe smss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe

Runs ping.exe 1 TTPs 18 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
1452	ping.exe
1704	ping.exe
960	ping.exe
1216	ping.exe
788	ping.exe
536	ping.exe
1868	ping.exe
768	ping.exe
1188	ping.exe
1612	ping.exe
1752	ping.exe
860	ping.exe
572	ping.exe
1760	ping.exe
2044	ping.exe
816	ping.exe
1912	ping.exe
1948	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exesmss.exelsass.exeservices.exe

pid	process
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1452	csrss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
1632	smss.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
996	lsass.exe
1592	services.exe
1592	services.exe
1592	services.exe
1592	services.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

1192 rundll32.exe
1680 rundll32.exe
1592 rundll32.exe
684 rundll32.exe
1056 rundll32.exe
1632 rundll32.exe

pid	process
1192	rundll32.exe
1680	rundll32.exe
1592	rundll32.exe
684	rundll32.exe
1056	rundll32.exe
1632	rundll32.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe csrss.execsrss.exe csrss.execsrss.exe scaa.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exesmss.exelsass.exelsass.exeservices.exeservices.exelsass.exe services.exeservices.exe smss.exe lsass.exe services.exe services.exe services.exewinlogon.exeservices.exe winlogon.exewinlogon.exewinlogon.exewinlogon.exe csrss.exewinlogon.exe winlogon.exe winlogon.exe csrss.exe Paraysutki_VM_Communitysmss.execsrss.exeParaysutki_VM_CommunityParaysutki_VM_Communitycsrss.exe smss.exe lsass.exesmss.exelsass.exe smss.exe lsass.exelsass.exe services.exeservices.exe services.exeservices.exe winlogon.exewinlogon.exe winlogon.exe

pid	process
536	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
1452	csrss.exe
732	csrss.exe
888	csrss.exe
1684	csrss.exe
1556	scaa.exe
1632	smss.exe
288	smss.exe
1552	csrss.exe
1952	csrss.exe
1764	smss.exe
984	smss.exe
996	lsass.exe
944	lsass.exe
1460	csrss.exe
1124	csrss.exe
1700	smss.exe
760	smss.exe
272	lsass.exe
1112	smss.exe
1060	lsass.exe
520	lsass.exe
1592	services.exe
1816	services.exe
1880	lsass.exe
736	services.exe
1628	services.exe
796	smss.exe
2016	lsass.exe
1524	services.exe
1664	services.exe
1160	services.exe
1176	winlogon.exe
1576	services.exe
1340	winlogon.exe
2000	winlogon.exe
1912	winlogon.exe
1096	winlogon.exe
1812	csrss.exe
544	winlogon.exe
1640	winlogon.exe
1708	winlogon.exe
2040	csrss.exe
920	Paraysutki_VM_Community
1744	smss.exe
1892	csrss.exe
2004	Paraysutki_VM_Community
1764	Paraysutki_VM_Community
996	csrss.exe
1460	smss.exe
796	lsass.exe
1128	smss.exe
1736	lsass.exe
1952	smss.exe
752	lsass.exe
900	lsass.exe
1524	services.exe
2040	services.exe
1448	services.exe
1612	services.exe
1812	winlogon.exe
1704	winlogon.exe
1128	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 536 wrote to memory of 1108	536	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
PID 536 wrote to memory of 1108	536	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
PID 536 wrote to memory of 1108	536	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
PID 536 wrote to memory of 1108	536	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
PID 1108 wrote to memory of 1452	1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe	csrss.exe
PID 1108 wrote to memory of 1452	1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe	csrss.exe
PID 1108 wrote to memory of 1452	1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe	csrss.exe
PID 1108 wrote to memory of 1452	1108	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe	csrss.exe
PID 1452 wrote to memory of 732	1452	csrss.exe	csrss.exe
PID 1452 wrote to memory of 732	1452	csrss.exe	csrss.exe
PID 1452 wrote to memory of 732	1452	csrss.exe	csrss.exe
PID 1452 wrote to memory of 732	1452	csrss.exe	csrss.exe
PID 732 wrote to memory of 888	732	csrss.exe	csrss.exe
PID 732 wrote to memory of 888	732	csrss.exe	csrss.exe
PID 732 wrote to memory of 888	732	csrss.exe	csrss.exe
PID 732 wrote to memory of 888	732	csrss.exe	csrss.exe
PID 888 wrote to memory of 1684	888	csrss.exe	csrss.exe
PID 888 wrote to memory of 1684	888	csrss.exe	csrss.exe
PID 888 wrote to memory of 1684	888	csrss.exe	csrss.exe
PID 888 wrote to memory of 1684	888	csrss.exe	csrss.exe
PID 888 wrote to memory of 1556	888	csrss.exe	scaa.exe
PID 888 wrote to memory of 1556	888	csrss.exe	scaa.exe
PID 888 wrote to memory of 1556	888	csrss.exe	scaa.exe
PID 888 wrote to memory of 1556	888	csrss.exe	scaa.exe
PID 732 wrote to memory of 1632	732	csrss.exe	smss.exe
PID 732 wrote to memory of 1632	732	csrss.exe	smss.exe
PID 732 wrote to memory of 1632	732	csrss.exe	smss.exe
PID 732 wrote to memory of 1632	732	csrss.exe	smss.exe
PID 1632 wrote to memory of 288	1632	smss.exe	smss.exe
PID 1632 wrote to memory of 288	1632	smss.exe	smss.exe
PID 1632 wrote to memory of 288	1632	smss.exe	smss.exe
PID 1632 wrote to memory of 288	1632	smss.exe	smss.exe
PID 288 wrote to memory of 1552	288	smss.exe	csrss.exe
PID 288 wrote to memory of 1552	288	smss.exe	csrss.exe
PID 288 wrote to memory of 1552	288	smss.exe	csrss.exe
PID 288 wrote to memory of 1552	288	smss.exe	csrss.exe
PID 1552 wrote to memory of 1952	1552	csrss.exe	csrss.exe
PID 1552 wrote to memory of 1952	1552	csrss.exe	csrss.exe
PID 1552 wrote to memory of 1952	1552	csrss.exe	csrss.exe
PID 1552 wrote to memory of 1952	1552	csrss.exe	csrss.exe
PID 288 wrote to memory of 1764	288	smss.exe	smss.exe
PID 288 wrote to memory of 1764	288	smss.exe	smss.exe
PID 288 wrote to memory of 1764	288	smss.exe	smss.exe
PID 288 wrote to memory of 1764	288	smss.exe	smss.exe
PID 1764 wrote to memory of 984	1764	smss.exe	smss.exe
PID 1764 wrote to memory of 984	1764	smss.exe	smss.exe
PID 1764 wrote to memory of 984	1764	smss.exe	smss.exe
PID 1764 wrote to memory of 984	1764	smss.exe	smss.exe
PID 288 wrote to memory of 996	288	smss.exe	lsass.exe
PID 288 wrote to memory of 996	288	smss.exe	lsass.exe
PID 288 wrote to memory of 996	288	smss.exe	lsass.exe
PID 288 wrote to memory of 996	288	smss.exe	lsass.exe
PID 996 wrote to memory of 944	996	lsass.exe	lsass.exe
PID 996 wrote to memory of 944	996	lsass.exe	lsass.exe
PID 996 wrote to memory of 944	996	lsass.exe	lsass.exe
PID 996 wrote to memory of 944	996	lsass.exe	lsass.exe
PID 944 wrote to memory of 1460	944	lsass.exe	csrss.exe
PID 944 wrote to memory of 1460	944	lsass.exe	csrss.exe
PID 944 wrote to memory of 1460	944	lsass.exe	csrss.exe
PID 944 wrote to memory of 1460	944	lsass.exe	csrss.exe
PID 1460 wrote to memory of 1124	1460	csrss.exe	csrss.exe
PID 1460 wrote to memory of 1124	1460	csrss.exe	csrss.exe
PID 1460 wrote to memory of 1124	1460	csrss.exe	csrss.exe
PID 1460 wrote to memory of 1124	1460	csrss.exe	csrss.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

lsass.exe smss.exe 9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe winlogon.exe services.exe csrss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

C:\Users\Admin\AppData\Local\Temp\9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
"C:\Users\Admin\AppData\Local\Temp\9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Local\Temp\9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
C:\Users\Admin\AppData\Local\Temp\9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1108

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:732

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1684

\??\c:\Documents and Settings\Admin\Application Data\Microsoft\scaa.exe
"c:\Documents and Settings\Admin\Application Data\Microsoft\scaa.exe" csrss
6⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1556

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:288

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1952

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:984

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
8⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:944

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1124

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:760

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:272

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:736

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1340

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1096

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
9⤵
- Suspicious use of FindShellTrayWindow
PID:1632

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:1912

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:536

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:572

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1592

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
8⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1628

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1812

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:796

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1812

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1704

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
9⤵
PID:360

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
9⤵
- Suspicious use of FindShellTrayWindow
PID:1056

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:1612

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:1704

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:960

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
7⤵
- Suspicious use of FindShellTrayWindow
PID:1192

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1868

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1948

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1452

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:520

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1816

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1912

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
- Suspicious use of FindShellTrayWindow
PID:684

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:816

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:1188

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:788

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1112

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:796

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1060

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
4⤵
- Executes dropped EXE
PID:1976

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1160

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1176

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:544

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1892

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:996

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1128

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:752

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1448

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1612

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1128

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
6⤵
PID:272

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
5⤵
PID:1928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
- Suspicious use of FindShellTrayWindow
PID:1592

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:2044

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:860

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:1216

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
3⤵
PID:1752

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
3⤵
- Suspicious use of FindShellTrayWindow
PID:1680

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:1752

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:1760

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:768

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-7901399701147064309-2024412339-1188626688-15725832561796636901697848138262147246"
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\scaa.exe

Filesize
76KB

MD5
0fe3dc0c012d2a2eb4df3869f469b760

SHA1
59ef95caf43401529cc95374f2953f6cf8729f80

SHA256
85f8bdb0c52c1fddf45efff3072de02af165137f439870d879289b1257d8b8a0

SHA512
3943a99d6a1f50325c1730114ebb1871ef1ce4ebf35f92789faa7797ee2f113f46a3ed508ccf589a9b4591bc2d6431189fab8494656e5a2a97cae9d6e3ae0214

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\scaa.exe

Filesize
76KB

MD5
0fe3dc0c012d2a2eb4df3869f469b760

SHA1
59ef95caf43401529cc95374f2953f6cf8729f80

SHA256
85f8bdb0c52c1fddf45efff3072de02af165137f439870d879289b1257d8b8a0

SHA512
3943a99d6a1f50325c1730114ebb1871ef1ce4ebf35f92789faa7797ee2f113f46a3ed508ccf589a9b4591bc2d6431189fab8494656e5a2a97cae9d6e3ae0214

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
\Users\Admin\AppData\Local\Temp\9794140876af52d9df2ec6da5a3dfbc46cf8032922ead79d2857a390100d6219.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\scaa.exe

Filesize
76KB

MD5
0fe3dc0c012d2a2eb4df3869f469b760

SHA1
59ef95caf43401529cc95374f2953f6cf8729f80

SHA256
85f8bdb0c52c1fddf45efff3072de02af165137f439870d879289b1257d8b8a0

SHA512
3943a99d6a1f50325c1730114ebb1871ef1ce4ebf35f92789faa7797ee2f113f46a3ed508ccf589a9b4591bc2d6431189fab8494656e5a2a97cae9d6e3ae0214

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\scaa.exe

Filesize
76KB

MD5
0fe3dc0c012d2a2eb4df3869f469b760

SHA1
59ef95caf43401529cc95374f2953f6cf8729f80

SHA256
85f8bdb0c52c1fddf45efff3072de02af165137f439870d879289b1257d8b8a0

SHA512
3943a99d6a1f50325c1730114ebb1871ef1ce4ebf35f92789faa7797ee2f113f46a3ed508ccf589a9b4591bc2d6431189fab8494656e5a2a97cae9d6e3ae0214

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
163KB

MD5
e5915e6311bc6f01429a191c45686280

SHA1
a8649c213b6b343a6cc3adc80e2a49e37c10b824

SHA256
b62864c0db023f9cc6823eb077796d814726ad737e402ee3ef0c077b1e73e477

SHA512
9d71baebf52f10f6fcb04c24155fa8b92273c2bf89f879e56475029fa288f40db8d77e2f29b53de3889e178542f3e6ad01733ad31e2acc03759d7375eeddbc5b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe

Filesize
86KB

MD5
f8c8afe96c9efaecac648f1a96e45fd3

SHA1
21947b2ce0d2827d84ee4db4b8aa31bedb4d6298

SHA256
18fcd8e9650e18c390405ad0d12841f9c5640b3ae5057fbae9ffd04b7e920021

SHA512
fb92249a85d1a57f9048efd8b829f0edbdd131eacd6cc564f366877e135e27ecb246b71a1cea08bf573caae28921621c50c5b1823a8d907b011713d6f0e850af

Download Submit
memory/272-200-0x00000000002C0000-0x00000000002E9000-memory.dmp

Filesize
164KB

Download
memory/272-238-0x00000000002C0000-0x00000000002E9000-memory.dmp

Filesize
164KB

Download
memory/272-189-0x0000000000000000-mapping.dmp

Download
memory/288-124-0x0000000000000000-mapping.dmp

Download
memory/288-168-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/288-376-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/520-188-0x0000000000000000-mapping.dmp

Download
memory/520-246-0x00000000002E0000-0x0000000000309000-memory.dmp

Filesize
164KB

Download
memory/536-190-0x0000000000260000-0x0000000000289000-memory.dmp

Filesize
164KB

Download
memory/536-109-0x0000000000260000-0x0000000000289000-memory.dmp

Filesize
164KB

Download
memory/536-110-0x0000000000260000-0x0000000000289000-memory.dmp

Filesize
164KB

Download
memory/544-271-0x0000000000000000-mapping.dmp

Download
memory/544-288-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/684-330-0x0000000000000000-mapping.dmp

Download
memory/732-377-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/732-74-0x0000000000000000-mapping.dmp

Download
memory/732-113-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/736-202-0x0000000000000000-mapping.dmp

Download
memory/752-352-0x0000000000000000-mapping.dmp

Download
memory/760-182-0x0000000000000000-mapping.dmp

Download
memory/760-186-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/796-347-0x00000000002A0000-0x00000000002C9000-memory.dmp

Filesize
164KB

Download
memory/796-269-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/796-333-0x0000000000000000-mapping.dmp

Download
memory/796-240-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/796-199-0x0000000000000000-mapping.dmp

Download
memory/888-86-0x0000000000000000-mapping.dmp

Download
memory/900-361-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/900-355-0x0000000000000000-mapping.dmp

Download
memory/920-297-0x0000000000000000-mapping.dmp

Download
memory/944-169-0x0000000000000000-mapping.dmp

Download
memory/944-185-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/944-321-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/984-155-0x0000000000000000-mapping.dmp

Download
memory/984-160-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/996-343-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/996-319-0x0000000000000000-mapping.dmp

Download
memory/996-163-0x0000000000000000-mapping.dmp

Download
memory/1060-191-0x0000000000000000-mapping.dmp

Download
memory/1060-245-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1060-225-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1096-290-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-273-0x0000000000000000-mapping.dmp

Download
memory/1108-58-0x0000000000000000-mapping.dmp

Download
memory/1108-111-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1112-187-0x0000000000000000-mapping.dmp

Download
memory/1124-175-0x0000000000000000-mapping.dmp

Download
memory/1124-178-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1128-336-0x0000000000000000-mapping.dmp

Download
memory/1160-244-0x0000000000310000-0x0000000000339000-memory.dmp

Filesize
164KB

Download
memory/1160-237-0x0000000000000000-mapping.dmp

Download
memory/1176-287-0x0000000000250000-0x0000000000279000-memory.dmp

Filesize
164KB

Download
memory/1176-283-0x0000000000250000-0x0000000000279000-memory.dmp

Filesize
164KB

Download
memory/1176-256-0x0000000000000000-mapping.dmp

Download
memory/1192-327-0x0000000000000000-mapping.dmp

Download
memory/1340-285-0x0000000001B70000-0x0000000001B99000-memory.dmp

Filesize
164KB

Download
memory/1340-257-0x0000000000000000-mapping.dmp

Download
memory/1448-365-0x0000000000000000-mapping.dmp

Download
memory/1452-64-0x0000000000000000-mapping.dmp

Download
memory/1452-112-0x0000000000270000-0x0000000000299000-memory.dmp

Filesize
164KB

Download
memory/1460-318-0x0000000000000000-mapping.dmp

Download
memory/1460-172-0x0000000000000000-mapping.dmp

Download
memory/1460-334-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1524-213-0x0000000000000000-mapping.dmp

Download
memory/1524-252-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1524-303-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1524-358-0x0000000000000000-mapping.dmp

Download
memory/1552-131-0x0000000000000000-mapping.dmp

Download
memory/1552-145-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1556-102-0x0000000000000000-mapping.dmp

Download
memory/1576-243-0x0000000000000000-mapping.dmp

Download
memory/1576-294-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1592-251-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1592-250-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1592-192-0x0000000000000000-mapping.dmp

Download
memory/1592-231-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1612-368-0x0000000000000000-mapping.dmp

Download
memory/1628-215-0x0000000000000000-mapping.dmp

Download
memory/1628-232-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1632-116-0x0000000000000000-mapping.dmp

Download
memory/1632-323-0x0000000000000000-mapping.dmp

Download
memory/1640-274-0x0000000000000000-mapping.dmp

Download
memory/1640-317-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1664-253-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1664-222-0x0000000000000000-mapping.dmp

Download
memory/1664-293-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1684-99-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1684-94-0x0000000000000000-mapping.dmp

Download
memory/1700-179-0x0000000000000000-mapping.dmp

Download
memory/1704-378-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1708-272-0x0000000000000000-mapping.dmp

Download
memory/1736-338-0x0000000000000000-mapping.dmp

Download
memory/1736-348-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1736-350-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1744-304-0x0000000000000000-mapping.dmp

Download
memory/1764-147-0x0000000000000000-mapping.dmp

Download
memory/1764-307-0x0000000000000000-mapping.dmp

Download
memory/1812-268-0x0000000000000000-mapping.dmp

Download
memory/1812-316-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1816-230-0x0000000000290000-0x00000000002B9000-memory.dmp

Filesize
164KB

Download
memory/1816-248-0x0000000000290000-0x00000000002B9000-memory.dmp

Filesize
164KB

Download
memory/1816-193-0x0000000000000000-mapping.dmp

Download
memory/1816-249-0x0000000000290000-0x00000000002B9000-memory.dmp

Filesize
164KB

Download
memory/1880-201-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1880-296-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1880-239-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1880-198-0x0000000000000000-mapping.dmp

Download
memory/1892-301-0x0000000000000000-mapping.dmp

Download
memory/1912-254-0x0000000000000000-mapping.dmp

Download
memory/1912-286-0x0000000000310000-0x0000000000339000-memory.dmp

Filesize
164KB

Download
memory/1952-351-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1952-344-0x0000000000000000-mapping.dmp

Download
memory/1952-138-0x0000000000000000-mapping.dmp

Download
memory/1952-349-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1952-143-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-208-0x0000000000000000-mapping.dmp

Download
memory/1976-229-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2000-289-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/2000-284-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/2000-255-0x0000000000000000-mapping.dmp

Download
memory/2004-309-0x0000000000000000-mapping.dmp

Download
memory/2016-247-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2016-210-0x0000000000000000-mapping.dmp

Download
memory/2016-270-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2016-228-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2040-291-0x0000000000000000-mapping.dmp

Download
memory/2040-362-0x0000000000000000-mapping.dmp

Download
memory/2040-369-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2040-308-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download