90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412

Analysis

max time kernel
152s
max time network
63s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Size

205KB
MD5

da35d0a8aa40579aead887722bccacb1
SHA1

7564332ecd857b2604121769e81cc04a808d03bf
SHA256

90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412
SHA512

157ddd73069b4c6157fede9ba253e9c580c323c1edb9cf931c68e9104685d6ac24942485b0106c27fa9674d83235dafc8777d94cdc3a12502e67933da97129c6
SSDEEP

3072:fqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:fqhMPssRARoiSoS3SsQLH5AK

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

winlogon.exe services.exe csrss.exe lsass.exe smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

services.exe csrss.exe lsass.exe smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe winlogon.exe csrss.exencsv.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	ncsv.exe

Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe csrss.exencsv.exeservices.exe csrss.exe lsass.exe smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ncsv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe winlogon.exe csrss.exencsv.exeservices.exe csrss.exe lsass.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ncsv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

lsass.exe smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe winlogon.exe services.exe csrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

csrss.exe lsass.exe smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe winlogon.exe services.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 64 IoCs

Processes:

90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe csrss.execsrss.exe csrss.execsrss.exe ncsv.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe smss.exesmss.exe lsass.exeservices.exelsass.exeservices.exewinlogon.exewinlogon.exewinlogon.exelsass.exe services.exe services.exe lsass.exe winlogon.exe winlogon.exe winlogon.exe services.exewinlogon.exeservices.exe winlogon.exe ~Paraysutki_VM_Community~~Paraysutki_VM_Community~~Paraysutki_VM_Community~winlogon.exe~Paraysutki_VM_Community~winlogon.exe csrss.execsrss.exe ~Paraysutki_VM_Community~smss.exesmss.exe lsass.exerundll32.exeservices.exe

pid	process
1108	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
320	csrss.exe
1620	csrss.exe
524	csrss.exe
1596	csrss.exe
1356	ncsv.exe
1628	smss.exe
1060	smss.exe
2040	csrss.exe
1120	csrss.exe
616	smss.exe
2012	smss.exe
1228	lsass.exe
1496	lsass.exe
1092	csrss.exe
964	csrss.exe
1732	smss.exe
908	smss.exe
588	lsass.exe
1032	lsass.exe
1568	services.exe
1616	services.exe
848	csrss.exe
880	csrss.exe
556	smss.exe
1756	smss.exe
300	lsass.exe
1540	lsass.exe
1652	services.exe
836	services.exe
1884	smss.exe
1752	smss.exe
1532	lsass.exe
2040	services.exe
1792	lsass.exe
2000	services.exe
1876	winlogon.exe
1404	winlogon.exe
616	winlogon.exe
1640	lsass.exe
528	services.exe
1200	services.exe
588	lsass.exe
560	winlogon.exe
1888	winlogon.exe
1948	winlogon.exe
1596	services.exe
1036	winlogon.exe
804	services.exe
1860	winlogon.exe
1656	~Paraysutki_VM_Community~
1992	~Paraysutki_VM_Community~
1316	~Paraysutki_VM_Community~
1008	winlogon.exe
1120	~Paraysutki_VM_Community~
1584	winlogon.exe
676	csrss.exe
1464	csrss.exe
1840	~Paraysutki_VM_Community~
2036	smss.exe
1692	smss.exe
1792	lsass.exe
2008	rundll32.exe
612	services.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

services.exe csrss.exe winlogon.exe smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe lsass.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe\Debugger = "cmd.exe /c del"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	winlogon.exe

Loads dropped DLL 64 IoCs

Processes:

pid	process
1844	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
1844	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
1108	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
1108	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
1620	csrss.exe
1620	csrss.exe
1620	csrss.exe
524	csrss.exe
524	csrss.exe
1596	csrss.exe
524	csrss.exe
524	csrss.exe
1620	csrss.exe
1620	csrss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1060	smss.exe
1060	smss.exe
1060	smss.exe
2040	csrss.exe
2040	csrss.exe
1120	csrss.exe
1060	smss.exe
1060	smss.exe
616	smss.exe
616	smss.exe
2012	smss.exe
1060	smss.exe
1060	smss.exe
1228	lsass.exe
1228	lsass.exe
1228	lsass.exe
1496	lsass.exe
1496	lsass.exe
1496	lsass.exe
1092	csrss.exe
1092	csrss.exe
964	csrss.exe
1496	lsass.exe
1496	lsass.exe
1732	smss.exe
1732	smss.exe
908	smss.exe
1496	lsass.exe
1496	lsass.exe
588	lsass.exe
588	lsass.exe
1032	lsass.exe
1496	lsass.exe
1496	lsass.exe
1568	services.exe
1568	services.exe
1568	services.exe
1616	services.exe
1616	services.exe
1616	services.exe
848	csrss.exe
848	csrss.exe
880	csrss.exe
1616	services.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe services.exe lsass.exe smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe csrss.exe ncsv.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe winlogon.exe services.exe csrss.exe lsass.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ncsv.exe

description	ioc	process
File opened (read-only)	\??\E:	ncsv.exe
File opened (read-only)	\??\K:	ncsv.exe
File opened (read-only)	\??\O:	ncsv.exe
File opened (read-only)	\??\S:	ncsv.exe
File opened (read-only)	\??\X:	ncsv.exe
File opened (read-only)	\??\V:	ncsv.exe
File opened (read-only)	\??\W:	ncsv.exe
File opened (read-only)	\??\Y:	ncsv.exe
File opened (read-only)	\??\G:	ncsv.exe
File opened (read-only)	\??\J:	ncsv.exe
File opened (read-only)	\??\L:	ncsv.exe
File opened (read-only)	\??\N:	ncsv.exe
File opened (read-only)	\??\T:	ncsv.exe
File opened (read-only)	\??\H:	ncsv.exe
File opened (read-only)	\??\M:	ncsv.exe
File opened (read-only)	\??\P:	ncsv.exe
File opened (read-only)	\??\R:	ncsv.exe
File opened (read-only)	\??\Z:	ncsv.exe
File opened (read-only)	\??\B:	ncsv.exe
File opened (read-only)	\??\F:	ncsv.exe
File opened (read-only)	\??\I:	ncsv.exe
File opened (read-only)	\??\Q:	ncsv.exe
File opened (read-only)	\??\U:	ncsv.exe

Drops file in System32 directory 64 IoCs

Processes:

ncsv.exesmss.exe lsass.exe winlogon.exe90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe services.exe winlogon.exe csrss.execsrss.exe winlogon.execsrss.exelsass.exelsass.exeservices.execsrss.exeservices.execsrss.exe~Paraysutki_VM_Community~services.exewinlogon.exesmss.exelsass.exeservices.exe~Paraysutki_VM_Community~smss.exelsass.exe

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	ncsv.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	csrss.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	ncsv.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	csrss.exe

Drops file in Program Files directory 35 IoCs

Processes:

ncsv.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\PublishExport.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	ncsv.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	ncsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe winlogon.exe services.exe lsass.exe smss.exe csrss.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe

Modifies registry class 48 IoCs

Processes:

csrss.exencsv.exelsass.exe winlogon.exe smss.exe csrss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe services.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	ncsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	ncsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	ncsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	ncsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	ncsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	ncsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	ncsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	ncsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	ncsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe

Runs ping.exe 1 TTPs 18 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
1048	ping.exe
2044	ping.exe
1064	ping.exe
1324	ping.exe
2508	ping.exe
664	ping.exe
1740	ping.exe
1972	ping.exe
572	ping.exe
1876	ping.exe
2016	ping.exe
984	ping.exe
2516	ping.exe
2500	ping.exe
1032	ping.exe
560	ping.exe
1404	ping.exe
1180	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exesmss.exelsass.exe

pid	process
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
320	csrss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1628	smss.exe
1228	lsass.exe
1228	lsass.exe
1228	lsass.exe
1228	lsass.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

824 rundll32.exe
556 rundll32.exe
1784 rundll32.exe
1556 rundll32.exe
1044 rundll32.exe
2456 rundll32.exe

pid	process
824	rundll32.exe
556	rundll32.exe
1784	rundll32.exe
1556	rundll32.exe
1044	rundll32.exe
2456	rundll32.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe csrss.execsrss.exe csrss.execsrss.exe ncsv.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe smss.exesmss.exe lsass.exeservices.exeservices.exewinlogon.exewinlogon.exewinlogon.exelsass.exelsass.exe services.exe services.exe winlogon.exe winlogon.exe winlogon.exe winlogon.exeservices.exelsass.exe services.exe winlogon.exe winlogon.exe~Paraysutki_VM_Community~~Paraysutki_VM_Community~~Paraysutki_VM_Community~winlogon.exe ~Paraysutki_VM_Community~csrss.exe~Paraysutki_VM_Community~csrss.exe smss.exesmss.exe lsass.exerundll32.exe

pid	process
1844	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
1108	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
320	csrss.exe
1620	csrss.exe
524	csrss.exe
1596	csrss.exe
1356	ncsv.exe
1628	smss.exe
1060	smss.exe
2040	csrss.exe
1120	csrss.exe
616	smss.exe
2012	smss.exe
1228	lsass.exe
1496	lsass.exe
1092	csrss.exe
964	csrss.exe
1732	smss.exe
908	smss.exe
588	lsass.exe
1032	lsass.exe
1568	services.exe
1616	services.exe
848	csrss.exe
880	csrss.exe
556	smss.exe
1756	smss.exe
300	lsass.exe
1540	lsass.exe
1652	services.exe
836	services.exe
1884	smss.exe
1752	smss.exe
1532	lsass.exe
2000	services.exe
2040	services.exe
1404	winlogon.exe
1876	winlogon.exe
616	winlogon.exe
1792	lsass.exe
1640	lsass.exe
528	services.exe
1200	services.exe
1948	winlogon.exe
1888	winlogon.exe
560	winlogon.exe
1036	winlogon.exe
1596	services.exe
588	lsass.exe
804	services.exe
1860	winlogon.exe
1008	winlogon.exe
1120	~Paraysutki_VM_Community~
1316	~Paraysutki_VM_Community~
1656	~Paraysutki_VM_Community~
1584	winlogon.exe
1992	~Paraysutki_VM_Community~
676	csrss.exe
1840	~Paraysutki_VM_Community~
1464	csrss.exe
2036	smss.exe
1692	smss.exe
1792	lsass.exe
2008	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 1844 wrote to memory of 1108	1844	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
PID 1844 wrote to memory of 1108	1844	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
PID 1844 wrote to memory of 1108	1844	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
PID 1844 wrote to memory of 1108	1844	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
PID 1108 wrote to memory of 320	1108	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe	csrss.exe
PID 1108 wrote to memory of 320	1108	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe	csrss.exe
PID 1108 wrote to memory of 320	1108	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe	csrss.exe
PID 1108 wrote to memory of 320	1108	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe	csrss.exe
PID 320 wrote to memory of 1620	320	csrss.exe	csrss.exe
PID 320 wrote to memory of 1620	320	csrss.exe	csrss.exe
PID 320 wrote to memory of 1620	320	csrss.exe	csrss.exe
PID 320 wrote to memory of 1620	320	csrss.exe	csrss.exe
PID 1620 wrote to memory of 524	1620	csrss.exe	csrss.exe
PID 1620 wrote to memory of 524	1620	csrss.exe	csrss.exe
PID 1620 wrote to memory of 524	1620	csrss.exe	csrss.exe
PID 1620 wrote to memory of 524	1620	csrss.exe	csrss.exe
PID 524 wrote to memory of 1596	524	csrss.exe	csrss.exe
PID 524 wrote to memory of 1596	524	csrss.exe	csrss.exe
PID 524 wrote to memory of 1596	524	csrss.exe	csrss.exe
PID 524 wrote to memory of 1596	524	csrss.exe	csrss.exe
PID 524 wrote to memory of 1356	524	csrss.exe	ncsv.exe
PID 524 wrote to memory of 1356	524	csrss.exe	ncsv.exe
PID 524 wrote to memory of 1356	524	csrss.exe	ncsv.exe
PID 524 wrote to memory of 1356	524	csrss.exe	ncsv.exe
PID 1620 wrote to memory of 1628	1620	csrss.exe	smss.exe
PID 1620 wrote to memory of 1628	1620	csrss.exe	smss.exe
PID 1620 wrote to memory of 1628	1620	csrss.exe	smss.exe
PID 1620 wrote to memory of 1628	1620	csrss.exe	smss.exe
PID 1628 wrote to memory of 1060	1628	smss.exe	smss.exe
PID 1628 wrote to memory of 1060	1628	smss.exe	smss.exe
PID 1628 wrote to memory of 1060	1628	smss.exe	smss.exe
PID 1628 wrote to memory of 1060	1628	smss.exe	smss.exe
PID 1060 wrote to memory of 2040	1060	smss.exe	csrss.exe
PID 1060 wrote to memory of 2040	1060	smss.exe	csrss.exe
PID 1060 wrote to memory of 2040	1060	smss.exe	csrss.exe
PID 1060 wrote to memory of 2040	1060	smss.exe	csrss.exe
PID 2040 wrote to memory of 1120	2040	csrss.exe	csrss.exe
PID 2040 wrote to memory of 1120	2040	csrss.exe	csrss.exe
PID 2040 wrote to memory of 1120	2040	csrss.exe	csrss.exe
PID 2040 wrote to memory of 1120	2040	csrss.exe	csrss.exe
PID 1060 wrote to memory of 616	1060	smss.exe	smss.exe
PID 1060 wrote to memory of 616	1060	smss.exe	smss.exe
PID 1060 wrote to memory of 616	1060	smss.exe	smss.exe
PID 1060 wrote to memory of 616	1060	smss.exe	smss.exe
PID 616 wrote to memory of 2012	616	smss.exe	smss.exe
PID 616 wrote to memory of 2012	616	smss.exe	smss.exe
PID 616 wrote to memory of 2012	616	smss.exe	smss.exe
PID 616 wrote to memory of 2012	616	smss.exe	smss.exe
PID 1060 wrote to memory of 1228	1060	smss.exe	lsass.exe
PID 1060 wrote to memory of 1228	1060	smss.exe	lsass.exe
PID 1060 wrote to memory of 1228	1060	smss.exe	lsass.exe
PID 1060 wrote to memory of 1228	1060	smss.exe	lsass.exe
PID 1228 wrote to memory of 1496	1228	lsass.exe	lsass.exe
PID 1228 wrote to memory of 1496	1228	lsass.exe	lsass.exe
PID 1228 wrote to memory of 1496	1228	lsass.exe	lsass.exe
PID 1228 wrote to memory of 1496	1228	lsass.exe	lsass.exe
PID 1496 wrote to memory of 1092	1496	lsass.exe	csrss.exe
PID 1496 wrote to memory of 1092	1496	lsass.exe	csrss.exe
PID 1496 wrote to memory of 1092	1496	lsass.exe	csrss.exe
PID 1496 wrote to memory of 1092	1496	lsass.exe	csrss.exe
PID 1092 wrote to memory of 964	1092	csrss.exe	csrss.exe
PID 1092 wrote to memory of 964	1092	csrss.exe	csrss.exe
PID 1092 wrote to memory of 964	1092	csrss.exe	csrss.exe
PID 1092 wrote to memory of 964	1092	csrss.exe	csrss.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe csrss.exe lsass.exe smss.exe 90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe services.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe

C:\Users\Admin\AppData\Local\Temp\90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
"C:\Users\Admin\AppData\Local\Temp\90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844

C:\Users\Admin\AppData\Local\Temp\90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
C:\Users\Admin\AppData\Local\Temp\90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1108

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1620

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1596

\??\c:\Documents and Settings\Admin\Application Data\Microsoft\ncsv.exe
"c:\Documents and Settings\Admin\Application Data\Microsoft\ncsv.exe" csrss
6⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1356

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1060

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1120

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2012

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
8⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1496

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:964

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1732

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:908

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:588

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1032

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
10⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:848

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:880

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:556

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1756

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:300

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:836

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1876

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1948

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
11⤵
- Suspicious use of FindShellTrayWindow
PID:1556

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1740

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1324

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
11⤵
- Runs ping.exe
PID:1972

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
11⤵
PID:1264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
11⤵
PID:300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
11⤵
PID:388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
11⤵
PID:1820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
11⤵
PID:388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
11⤵
PID:1264

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
10⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1888

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:676

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1464

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2036

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1792

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
12⤵
PID:2008

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:612

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
12⤵
PID:1956

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
11⤵
PID:2392

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
12⤵
PID:2408

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
11⤵
- Drops file in System32 directory
PID:2432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
11⤵
- Suspicious use of FindShellTrayWindow
PID:2456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
11⤵
PID:2524

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
11⤵
- Runs ping.exe
PID:2516

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:2508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
11⤵
PID:2612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
11⤵
PID:2588

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:2500

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
11⤵
PID:2636

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
11⤵
PID:2648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
11⤵
PID:2664

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
9⤵
- Suspicious use of FindShellTrayWindow
PID:556

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:2044

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:560

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
9⤵
- Runs ping.exe
PID:2016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
9⤵
PID:1540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
9⤵
PID:1644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
9⤵
PID:836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
9⤵
PID:676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
9⤵
PID:1568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
9⤵
PID:836

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1200

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:616

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:560

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
7⤵
- Suspicious use of FindShellTrayWindow
PID:824

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1032

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1404

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
7⤵
- Runs ping.exe
PID:664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
7⤵
PID:1260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
7⤵
PID:1600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
7⤵
PID:1568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
7⤵
PID:1668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
7⤵
PID:1820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
7⤵
PID:1652

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:528

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1036

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1860

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
- Suspicious use of FindShellTrayWindow
PID:1044

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:1048

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:1180

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
5⤵
- Runs ping.exe
PID:1064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
5⤵
PID:1668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
5⤵
PID:676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
5⤵
PID:1884

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
5⤵
PID:1540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
5⤵
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
5⤵
PID:1468

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1884

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1792

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1596

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:804

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1008

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1584

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1840

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
3⤵
- Suspicious use of FindShellTrayWindow
PID:1784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
3⤵
PID:1600

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
3⤵
- Runs ping.exe
PID:572

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:1876

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
3⤵
PID:836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
3⤵
PID:1668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
3⤵
PID:688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
3⤵
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\ncsv.exe

Filesize
76KB

MD5
ca49c39173d7b78c7234ae5c6f4b9962

SHA1
b44cfb1d505139eeae4c170065ff8591da5950dc

SHA256
e417459dc524d867e8b8877abea4e7ce0c261e21ff525ff2a6d737cb8c08c363

SHA512
dbf98f43f3405340f6205ec800938684efb47612afd510c494551668ea4a2ef3bf0543b1617b6e833550748a9fd2b5145e9b8f19022c2f5625306f7b9b740628

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\ncsv.exe

Filesize
76KB

MD5
ca49c39173d7b78c7234ae5c6f4b9962

SHA1
b44cfb1d505139eeae4c170065ff8591da5950dc

SHA256
e417459dc524d867e8b8877abea4e7ce0c261e21ff525ff2a6d737cb8c08c363

SHA512
dbf98f43f3405340f6205ec800938684efb47612afd510c494551668ea4a2ef3bf0543b1617b6e833550748a9fd2b5145e9b8f19022c2f5625306f7b9b740628

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
5950c86e0878f588fdcba19f249d476d

SHA1
83b1887a3d5abdca874737d646b8afeccf25f1fa

SHA256
e003bc11da7a440d7d6b2b0a6f348298ac7c88564a27991153600f14b537f56b

SHA512
d689cec81e9ed4e44e893fedd0bb722c32575bcfec56b0a4a4e5d5f4d09cdcbd4760f5534d6a356f0b1a309846277031913eede9382af7781038444e3a9c4f1b

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Users\Admin\AppData\Local\Temp\90df6ccc83854e8870c21931b748a00e00a45aa8208b36ac616a3b4bc5329412.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\ncsv.exe

Filesize
76KB

MD5
ca49c39173d7b78c7234ae5c6f4b9962

SHA1
b44cfb1d505139eeae4c170065ff8591da5950dc

SHA256
e417459dc524d867e8b8877abea4e7ce0c261e21ff525ff2a6d737cb8c08c363

SHA512
dbf98f43f3405340f6205ec800938684efb47612afd510c494551668ea4a2ef3bf0543b1617b6e833550748a9fd2b5145e9b8f19022c2f5625306f7b9b740628

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\ncsv.exe

Filesize
76KB

MD5
ca49c39173d7b78c7234ae5c6f4b9962

SHA1
b44cfb1d505139eeae4c170065ff8591da5950dc

SHA256
e417459dc524d867e8b8877abea4e7ce0c261e21ff525ff2a6d737cb8c08c363

SHA512
dbf98f43f3405340f6205ec800938684efb47612afd510c494551668ea4a2ef3bf0543b1617b6e833550748a9fd2b5145e9b8f19022c2f5625306f7b9b740628

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
a895b0b61e849b29a88c255f2d6ce215

SHA1
a15391ca390eec66b2a3a58bc6a6e949e3882a4d

SHA256
007dc8f9a169443ae0ace493908bef6885b4daec32875cbe46d75fbdd698b08e

SHA512
e152915aafb082353c93b5489549dc2e30fe820e2060669bbedf349fc268729a98cd4ef1f89f75387922e9d3466f3614a8c4b9e90ad2b461f41b5dbbd78433ba

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
memory/300-216-0x0000000000000000-mapping.dmp

Download
memory/320-92-0x00000000001D0000-0x00000000001FA000-memory.dmp

Filesize
168KB

Download
memory/320-64-0x0000000000000000-mapping.dmp

Download
memory/524-87-0x0000000000000000-mapping.dmp

Download
memory/528-265-0x0000000000000000-mapping.dmp

Download
memory/528-314-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/528-275-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/556-209-0x0000000000000000-mapping.dmp

Download
memory/556-361-0x0000000000000000-mapping.dmp

Download
memory/560-356-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/560-279-0x0000000000000000-mapping.dmp

Download
memory/560-323-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/588-187-0x0000000000000000-mapping.dmp

Download
memory/588-318-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/588-278-0x0000000000000000-mapping.dmp

Download
memory/588-283-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/588-357-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/616-284-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/616-320-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/616-149-0x0000000000000000-mapping.dmp

Download
memory/616-249-0x0000000000000000-mapping.dmp

Download
memory/616-285-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/616-319-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/676-344-0x0000000000000000-mapping.dmp

Download
memory/804-300-0x0000000000000000-mapping.dmp

Download
memory/804-349-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/824-371-0x0000000000000000-mapping.dmp

Download
memory/836-226-0x0000000000000000-mapping.dmp

Download
memory/836-229-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/848-202-0x0000000000000000-mapping.dmp

Download
memory/880-205-0x0000000000000000-mapping.dmp

Download
memory/880-208-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/908-184-0x0000000000000000-mapping.dmp

Download
memory/964-179-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/964-176-0x0000000000000000-mapping.dmp

Download
memory/1008-353-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1008-312-0x0000000000000000-mapping.dmp

Download
memory/1032-190-0x0000000000000000-mapping.dmp

Download
memory/1032-193-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1036-306-0x0000000000260000-0x000000000028A000-memory.dmp

Filesize
168KB

Download
memory/1036-290-0x0000000000000000-mapping.dmp

Download
memory/1044-354-0x0000000000000000-mapping.dmp

Download
memory/1060-144-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1060-124-0x0000000000000000-mapping.dmp

Download
memory/1092-180-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1092-173-0x0000000000000000-mapping.dmp

Download
memory/1108-89-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1108-58-0x0000000000000000-mapping.dmp

Download
memory/1120-138-0x0000000000000000-mapping.dmp

Download
memory/1120-145-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1120-316-0x0000000000000000-mapping.dmp

Download
memory/1120-146-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1200-342-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1200-266-0x0000000000000000-mapping.dmp

Download
memory/1200-315-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1228-165-0x0000000000000000-mapping.dmp

Download
memory/1228-196-0x00000000002C0000-0x00000000002EA000-memory.dmp

Filesize
168KB

Download
memory/1316-311-0x0000000000000000-mapping.dmp

Download
memory/1356-107-0x0000000000000000-mapping.dmp

Download
memory/1404-247-0x0000000000000000-mapping.dmp

Download
memory/1404-287-0x00000000005B0000-0x00000000005DA000-memory.dmp

Filesize
168KB

Download
memory/1404-321-0x00000000005B0000-0x00000000005DA000-memory.dmp

Filesize
168KB

Download
memory/1404-286-0x00000000005B0000-0x00000000005DA000-memory.dmp

Filesize
168KB

Download
memory/1404-322-0x00000000005B0000-0x00000000005DA000-memory.dmp

Filesize
168KB

Download
memory/1464-363-0x0000000000000000-mapping.dmp

Download
memory/1496-170-0x0000000000000000-mapping.dmp

Download
memory/1496-197-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1532-240-0x0000000000000000-mapping.dmp

Download
memory/1532-313-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1532-271-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1540-219-0x0000000000000000-mapping.dmp

Download
memory/1540-222-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1556-351-0x0000000000000000-mapping.dmp

Download
memory/1568-194-0x0000000000000000-mapping.dmp

Download
memory/1568-244-0x00000000003C0000-0x00000000003EA000-memory.dmp

Filesize
168KB

Download
memory/1568-230-0x00000000003C0000-0x00000000003EA000-memory.dmp

Filesize
168KB

Download
memory/1584-331-0x0000000000000000-mapping.dmp

Download
memory/1584-350-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1596-305-0x00000000002E0000-0x000000000030A000-memory.dmp

Filesize
168KB

Download
memory/1596-104-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1596-99-0x0000000000000000-mapping.dmp

Download
memory/1596-289-0x0000000000000000-mapping.dmp

Download
memory/1616-347-0x0000000075E61000-0x0000000075E63000-memory.dmp

Filesize
8KB

Download
memory/1616-199-0x0000000000000000-mapping.dmp

Download
memory/1616-231-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1620-74-0x0000000000000000-mapping.dmp

Download
memory/1620-94-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1628-116-0x0000000000000000-mapping.dmp

Download
memory/1628-143-0x00000000001C0000-0x00000000001EA000-memory.dmp

Filesize
168KB

Download
memory/1640-257-0x0000000000000000-mapping.dmp

Download
memory/1640-272-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1640-343-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1652-223-0x0000000000000000-mapping.dmp

Download
memory/1656-309-0x0000000000000000-mapping.dmp

Download
memory/1692-379-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1732-181-0x0000000000000000-mapping.dmp

Download
memory/1752-235-0x0000000000000000-mapping.dmp

Download
memory/1752-330-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1752-239-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1756-215-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1756-212-0x0000000000000000-mapping.dmp

Download
memory/1784-372-0x0000000000000000-mapping.dmp

Download
memory/1792-245-0x0000000000000000-mapping.dmp

Download
memory/1792-317-0x00000000005B0000-0x00000000005DA000-memory.dmp

Filesize
168KB

Download
memory/1792-282-0x00000000005B0000-0x00000000005DA000-memory.dmp

Filesize
168KB

Download
memory/1840-364-0x0000000000000000-mapping.dmp

Download
memory/1844-88-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1844-243-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1844-83-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1844-242-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1860-345-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1860-302-0x0000000000000000-mapping.dmp

Download
memory/1876-288-0x0000000000260000-0x000000000028A000-memory.dmp

Filesize
168KB

Download
memory/1876-248-0x0000000000000000-mapping.dmp

Download
memory/1884-238-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1884-232-0x0000000000000000-mapping.dmp

Download
memory/1888-324-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1888-280-0x0000000000000000-mapping.dmp

Download
memory/1948-346-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1948-281-0x0000000000000000-mapping.dmp

Download
memory/1948-325-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1992-310-0x0000000000000000-mapping.dmp

Download
memory/2000-246-0x0000000000000000-mapping.dmp

Download
memory/2000-273-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/2012-162-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2012-157-0x0000000000000000-mapping.dmp

Download
memory/2040-274-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/2040-241-0x0000000000000000-mapping.dmp

Download
memory/2040-131-0x0000000000000000-mapping.dmp

Download