7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931

Analysis

max time kernel
153s
max time network
65s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Size

127KB
MD5

e8059f3c680e7424c0e67d8c971cb4dd
SHA1

ca917619ccf8346478989a12da5a8753bb452e3d
SHA256

7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931
SHA512

6279f2e9328da59b00cd5f2a9db3f9ee8bc8f27978916b9f05c145cce153f4669ffd6db82a8eceddc619e5471673e5b88276d7ff1c84535504d8b605d2149bb7
SSDEEP

1536:hnqdu3rbBGy3G8V0iuoKYMUYU6U5jUdPQc+n35KZg8/nouy8Iu:hqYMPsLMYjUtQl78vout

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

services.exe smss.exe lsass.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

smss.exe lsass.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe winlogon.exe csrss.exescaa.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe

Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

lsass.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe winlogon.exe csrss.exescaa.exeservices.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	scaa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

scaa.exeservices.exe smss.exe lsass.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe winlogon.exe csrss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	scaa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

smss.exe lsass.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe winlogon.exe services.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe winlogon.exe services.exe smss.exe lsass.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 64 IoCs

Processes:

7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.execsrss.exe csrss.execsrss.exe scaa.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe smss.exelsass.exeservices.exeservices.exelsass.exeservices.exewinlogon.exewinlogon.exelsass.exe services.exe winlogon.exeservices.exe lsass.exe smss.exe winlogon.exe winlogon.exe winlogon.exe services.exe services.exewinlogon.exeParaysutki_VM_CommunityParaysutki_VM_CommunityParaysutki_VM_Communitywinlogon.exeParaysutki_VM_Communitywinlogon.exe winlogon.exe services.exe csrss.exeParaysutki_VM_Communitycsrss.exe smss.exesmss.exe lsass.exelsass.exe conhost.exe

pid	process
1272	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
604	csrss.exe
636	csrss.exe
1156	csrss.exe
1780	csrss.exe
872	scaa.exe
936	smss.exe
1448	smss.exe
1752	csrss.exe
1344	csrss.exe
1792	smss.exe
1036	smss.exe
900	lsass.exe
2012	lsass.exe
1512	csrss.exe
2040	csrss.exe
1984	smss.exe
1720	smss.exe
768	lsass.exe
1744	lsass.exe
592	services.exe
1976	services.exe
608	csrss.exe
832	csrss.exe
1664	smss.exe
576	smss.exe
924	lsass.exe
1028	lsass.exe
612	smss.exe
1884	lsass.exe
1652	services.exe
1752	services.exe
864	lsass.exe
1296	services.exe
948	winlogon.exe
1036	winlogon.exe
1608	lsass.exe
1544	services.exe
580	winlogon.exe
1748	services.exe
1720	lsass.exe
588	smss.exe
1828	winlogon.exe
768	winlogon.exe
560	winlogon.exe
1192	services.exe
1092	services.exe
1072	winlogon.exe
756	Paraysutki_VM_Community
1664	Paraysutki_VM_Community
576	Paraysutki_VM_Community
1528	winlogon.exe
1960	Paraysutki_VM_Community
1836	winlogon.exe
1280	winlogon.exe
316	services.exe
832	csrss.exe
1824	Paraysutki_VM_Community
772	csrss.exe
524	smss.exe
900	smss.exe
936	lsass.exe
1000	lsass.exe
2036	conhost.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

services.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe lsass.exe csrss.exe winlogon.exe smss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe\Debugger = "cmd.exe /c del"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe

Loads dropped DLL 64 IoCs

Processes:

pid	process
1428	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
1428	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
1272	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
1272	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
636	csrss.exe
636	csrss.exe
636	csrss.exe
1156	csrss.exe
1156	csrss.exe
1780	csrss.exe
1156	csrss.exe
1156	csrss.exe
636	csrss.exe
636	csrss.exe
936	smss.exe
936	smss.exe
936	smss.exe
1448	smss.exe
1448	smss.exe
1448	smss.exe
1752	csrss.exe
1752	csrss.exe
1344	csrss.exe
1448	smss.exe
1448	smss.exe
1792	smss.exe
1792	smss.exe
1036	smss.exe
1448	smss.exe
1448	smss.exe
900	lsass.exe
900	lsass.exe
900	lsass.exe
2012	lsass.exe
2012	lsass.exe
2012	lsass.exe
1512	csrss.exe
1512	csrss.exe
2040	csrss.exe
2012	lsass.exe
2012	lsass.exe
1984	smss.exe
1984	smss.exe
1720	smss.exe
2012	lsass.exe
2012	lsass.exe
768	lsass.exe
768	lsass.exe
1744	lsass.exe
2012	lsass.exe
2012	lsass.exe
592	services.exe
592	services.exe
592	services.exe
1976	services.exe
1976	services.exe
1976	services.exe
608	csrss.exe
608	csrss.exe
832	csrss.exe
1976	services.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe winlogon.exe scaa.exeservices.exe smss.exe lsass.exe csrss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	csrss.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

winlogon.exe services.exe smss.exe lsass.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

scaa.exe

description	ioc	process
File opened (read-only)	\??\E:	scaa.exe
File opened (read-only)	\??\H:	scaa.exe
File opened (read-only)	\??\N:	scaa.exe
File opened (read-only)	\??\U:	scaa.exe
File opened (read-only)	\??\V:	scaa.exe
File opened (read-only)	\??\X:	scaa.exe
File opened (read-only)	\??\G:	scaa.exe
File opened (read-only)	\??\J:	scaa.exe
File opened (read-only)	\??\K:	scaa.exe
File opened (read-only)	\??\P:	scaa.exe
File opened (read-only)	\??\T:	scaa.exe
File opened (read-only)	\??\Z:	scaa.exe
File opened (read-only)	\??\B:	scaa.exe
File opened (read-only)	\??\F:	scaa.exe
File opened (read-only)	\??\I:	scaa.exe
File opened (read-only)	\??\L:	scaa.exe
File opened (read-only)	\??\S:	scaa.exe
File opened (read-only)	\??\W:	scaa.exe
File opened (read-only)	\??\Y:	scaa.exe
File opened (read-only)	\??\M:	scaa.exe
File opened (read-only)	\??\O:	scaa.exe
File opened (read-only)	\??\Q:	scaa.exe
File opened (read-only)	\??\R:	scaa.exe

Drops file in System32 directory 64 IoCs

Processes:

smss.exewinlogon.exe winlogon.exeParaysutki_VM_Community7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe csrss.exescaa.exeservices.exe lsass.exe Paraysutki_VM_Communitysmss.exe lsass.execsrss.exewinlogon.exeservices.execsrss.exelsass.exeservices.exelsass.exesmss.exeservices.exeParaysutki_VM_CommunityParaysutki_VM_Communitycsrss.execsrss.exe

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File created	\??\c:\windows\SysWOW64\maxtrox.txt	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	winlogon.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	scaa.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	scaa.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	services.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	scaa.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	winlogon.exe

Drops file in Program Files directory 34 IoCs

Processes:

scaa.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	scaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	scaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	scaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	scaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	scaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	scaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

smss.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe winlogon.exe services.exe lsass.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	services.exe

Modifies registry class 48 IoCs

Processes:

csrss.exescaa.exeservices.exe smss.exe winlogon.exe lsass.exe csrss.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	scaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	scaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe

Runs ping.exe 1 TTPs 18 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
1368	ping.exe
1084	ping.exe
2332	ping.exe
576	ping.exe
1560	ping.exe
1160	ping.exe
1532	ping.exe
2340	ping.exe
2020	ping.exe
1752	ping.exe
2348	ping.exe
1372	ping.exe
1272	ping.exe
772	ping.exe
864	ping.exe
936	ping.exe
1764	ping.exe
2040	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exesmss.exelsass.exe

pid	process
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
900	lsass.exe
900	lsass.exe
900	lsass.exe
900	lsass.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

1948 rundll32.exe
1628 rundll32.exe
1576 rundll32.exe
896 rundll32.exe
1396 rundll32.exe

pid	process
1948	rundll32.exe
1628	rundll32.exe
1576	rundll32.exe
896	rundll32.exe
1396	rundll32.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.execsrss.exe csrss.execsrss.exe scaa.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exelsass.exeservices.exewinlogon.exelsass.exelsass.exe winlogon.exeservices.exeservices.exe smss.exeservices.exe winlogon.exelsass.exe winlogon.exesmss.exe winlogon.exeParaysutki_VM_Communitywinlogon.exe winlogon.exe services.exe winlogon.exe Paraysutki_VM_CommunityParaysutki_VM_Communitywinlogon.exe services.exeParaysutki_VM_Communitywinlogon.exe services.exe csrss.exeParaysutki_VM_Communitycsrss.exe smss.exesmss.exe lsass.exelsass.exe

pid	process
1428	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
1272	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
604	csrss.exe
636	csrss.exe
1156	csrss.exe
1780	csrss.exe
872	scaa.exe
936	smss.exe
1448	smss.exe
1752	csrss.exe
1344	csrss.exe
1792	smss.exe
1036	smss.exe
900	lsass.exe
2012	lsass.exe
1512	csrss.exe
2040	csrss.exe
1984	smss.exe
1720	smss.exe
768	lsass.exe
1744	lsass.exe
592	services.exe
1976	services.exe
608	csrss.exe
832	csrss.exe
1664	smss.exe
576	smss.exe
924	lsass.exe
1028	lsass.exe
1752	services.exe
1884	lsass.exe
1296	services.exe
580	winlogon.exe
864	lsass.exe
1608	lsass.exe
1036	winlogon.exe
1652	services.exe
1544	services.exe
612	smss.exe
1748	services.exe
948	winlogon.exe
1720	lsass.exe
1072	winlogon.exe
588	smss.exe
1528	winlogon.exe
756	Paraysutki_VM_Community
768	winlogon.exe
560	winlogon.exe
1192	services.exe
1828	winlogon.exe
576	Paraysutki_VM_Community
1664	Paraysutki_VM_Community
1836	winlogon.exe
1092	services.exe
1960	Paraysutki_VM_Community
1280	winlogon.exe
316	services.exe
832	csrss.exe
1824	Paraysutki_VM_Community
772	csrss.exe
524	smss.exe
900	smss.exe
936	lsass.exe
1000	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 1428 wrote to memory of 1272	1428	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
PID 1428 wrote to memory of 1272	1428	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
PID 1428 wrote to memory of 1272	1428	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
PID 1428 wrote to memory of 1272	1428	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
PID 1272 wrote to memory of 604	1272	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe	csrss.exe
PID 1272 wrote to memory of 604	1272	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe	csrss.exe
PID 1272 wrote to memory of 604	1272	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe	csrss.exe
PID 1272 wrote to memory of 604	1272	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe	csrss.exe
PID 604 wrote to memory of 636	604	csrss.exe	csrss.exe
PID 604 wrote to memory of 636	604	csrss.exe	csrss.exe
PID 604 wrote to memory of 636	604	csrss.exe	csrss.exe
PID 604 wrote to memory of 636	604	csrss.exe	csrss.exe
PID 636 wrote to memory of 1156	636	csrss.exe	csrss.exe
PID 636 wrote to memory of 1156	636	csrss.exe	csrss.exe
PID 636 wrote to memory of 1156	636	csrss.exe	csrss.exe
PID 636 wrote to memory of 1156	636	csrss.exe	csrss.exe
PID 1156 wrote to memory of 1780	1156	csrss.exe	csrss.exe
PID 1156 wrote to memory of 1780	1156	csrss.exe	csrss.exe
PID 1156 wrote to memory of 1780	1156	csrss.exe	csrss.exe
PID 1156 wrote to memory of 1780	1156	csrss.exe	csrss.exe
PID 1156 wrote to memory of 872	1156	csrss.exe	scaa.exe
PID 1156 wrote to memory of 872	1156	csrss.exe	scaa.exe
PID 1156 wrote to memory of 872	1156	csrss.exe	scaa.exe
PID 1156 wrote to memory of 872	1156	csrss.exe	scaa.exe
PID 636 wrote to memory of 936	636	csrss.exe	smss.exe
PID 636 wrote to memory of 936	636	csrss.exe	smss.exe
PID 636 wrote to memory of 936	636	csrss.exe	smss.exe
PID 636 wrote to memory of 936	636	csrss.exe	smss.exe
PID 936 wrote to memory of 1448	936	smss.exe	smss.exe
PID 936 wrote to memory of 1448	936	smss.exe	smss.exe
PID 936 wrote to memory of 1448	936	smss.exe	smss.exe
PID 936 wrote to memory of 1448	936	smss.exe	smss.exe
PID 1448 wrote to memory of 1752	1448	smss.exe	csrss.exe
PID 1448 wrote to memory of 1752	1448	smss.exe	csrss.exe
PID 1448 wrote to memory of 1752	1448	smss.exe	csrss.exe
PID 1448 wrote to memory of 1752	1448	smss.exe	csrss.exe
PID 1752 wrote to memory of 1344	1752	csrss.exe	csrss.exe
PID 1752 wrote to memory of 1344	1752	csrss.exe	csrss.exe
PID 1752 wrote to memory of 1344	1752	csrss.exe	csrss.exe
PID 1752 wrote to memory of 1344	1752	csrss.exe	csrss.exe
PID 1448 wrote to memory of 1792	1448	smss.exe	smss.exe
PID 1448 wrote to memory of 1792	1448	smss.exe	smss.exe
PID 1448 wrote to memory of 1792	1448	smss.exe	smss.exe
PID 1448 wrote to memory of 1792	1448	smss.exe	smss.exe
PID 1792 wrote to memory of 1036	1792	smss.exe	smss.exe
PID 1792 wrote to memory of 1036	1792	smss.exe	smss.exe
PID 1792 wrote to memory of 1036	1792	smss.exe	smss.exe
PID 1792 wrote to memory of 1036	1792	smss.exe	smss.exe
PID 1448 wrote to memory of 900	1448	smss.exe	lsass.exe
PID 1448 wrote to memory of 900	1448	smss.exe	lsass.exe
PID 1448 wrote to memory of 900	1448	smss.exe	lsass.exe
PID 1448 wrote to memory of 900	1448	smss.exe	lsass.exe
PID 900 wrote to memory of 2012	900	lsass.exe	lsass.exe
PID 900 wrote to memory of 2012	900	lsass.exe	lsass.exe
PID 900 wrote to memory of 2012	900	lsass.exe	lsass.exe
PID 900 wrote to memory of 2012	900	lsass.exe	lsass.exe
PID 2012 wrote to memory of 1512	2012	lsass.exe	csrss.exe
PID 2012 wrote to memory of 1512	2012	lsass.exe	csrss.exe
PID 2012 wrote to memory of 1512	2012	lsass.exe	csrss.exe
PID 2012 wrote to memory of 1512	2012	lsass.exe	csrss.exe
PID 1512 wrote to memory of 2040	1512	csrss.exe	csrss.exe
PID 1512 wrote to memory of 2040	1512	csrss.exe	csrss.exe
PID 1512 wrote to memory of 2040	1512	csrss.exe	csrss.exe
PID 1512 wrote to memory of 2040	1512	csrss.exe	csrss.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

lsass.exe 7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe csrss.exe winlogon.exe services.exe smss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
"C:\Users\Admin\AppData\Local\Temp\7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\AppData\Local\Temp\7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
C:\Users\Admin\AppData\Local\Temp\7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1272

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:636

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1780

\??\c:\Documents and Settings\Admin\Application Data\Microsoft\scaa.exe
"c:\Documents and Settings\Admin\Application Data\Microsoft\scaa.exe" csrss
6⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:872

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1448

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1344

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1036

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
8⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1720

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:768

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:592

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
10⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1976

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:608

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:832

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:576

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:924

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1028

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:580

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
12⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:768

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:832

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:772

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:524

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:936

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1000

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
13⤵
PID:2036

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
14⤵
PID:1892

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
13⤵
PID:1996

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
14⤵
PID:1668

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
13⤵
- Drops file in System32 directory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
13⤵
- Suspicious use of FindShellTrayWindow
PID:1396

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
13⤵
- Runs ping.exe
PID:1272

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
13⤵
- Runs ping.exe
PID:1532

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
13⤵
- Runs ping.exe
PID:936

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
11⤵
- Suspicious use of FindShellTrayWindow
PID:896

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:772

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1752

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1368

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:948

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:560

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
9⤵
PID:1592

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:2348

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:2340

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:2332

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1192

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1036

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1828

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
7⤵
- Suspicious use of FindShellTrayWindow
PID:1948

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1764

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:2020

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1372

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1884

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1608

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1296

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1748

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1072

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1836

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
- Suspicious use of FindShellTrayWindow
PID:1628

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:576

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:2040

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:1084

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:612

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:864

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1720

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1092

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:316

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1528

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1280

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
3⤵
- Suspicious use of FindShellTrayWindow
PID:1576

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:1560

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:864

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:1160

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1709375276-1140325553-2103682300801001652924410775-7037821001370144781-1623612185"
1⤵
- Executes dropped EXE
PID:2036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\scaa.exe
Filesize
76KB

MD5
89effc49fe2210c0ad1786336bfd18e8

SHA1
6bac26fb42af99eaee48ef40d1517ea23e3fd6c5

SHA256
1b08699746e9162a03c452e6255668cfbeea87ca330db60da185b4a758ce3740

SHA512
4150f18916fe741219e276734f4353d3d225435d4b25d41a21f817e91aecb412ceb0773915069aeff58cb88c244163b8ab59dd1215ebdd8d1fa52075cab02a44

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLL
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\scaa.exe
Filesize
76KB

MD5
89effc49fe2210c0ad1786336bfd18e8

SHA1
6bac26fb42af99eaee48ef40d1517ea23e3fd6c5

SHA256
1b08699746e9162a03c452e6255668cfbeea87ca330db60da185b4a758ce3740

SHA512
4150f18916fe741219e276734f4353d3d225435d4b25d41a21f817e91aecb412ceb0773915069aeff58cb88c244163b8ab59dd1215ebdd8d1fa52075cab02a44

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
\Users\Admin\AppData\Local\Temp\7bbd046adb4a13bf36140fff31f72c6f64fba21035f769869318e6707c9ce931.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\scaa.exe
Filesize
76KB

MD5
89effc49fe2210c0ad1786336bfd18e8

SHA1
6bac26fb42af99eaee48ef40d1517ea23e3fd6c5

SHA256
1b08699746e9162a03c452e6255668cfbeea87ca330db60da185b4a758ce3740

SHA512
4150f18916fe741219e276734f4353d3d225435d4b25d41a21f817e91aecb412ceb0773915069aeff58cb88c244163b8ab59dd1215ebdd8d1fa52075cab02a44

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\scaa.exe
Filesize
76KB

MD5
89effc49fe2210c0ad1786336bfd18e8

SHA1
6bac26fb42af99eaee48ef40d1517ea23e3fd6c5

SHA256
1b08699746e9162a03c452e6255668cfbeea87ca330db60da185b4a758ce3740

SHA512
4150f18916fe741219e276734f4353d3d225435d4b25d41a21f817e91aecb412ceb0773915069aeff58cb88c244163b8ab59dd1215ebdd8d1fa52075cab02a44

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
cfa1c296076a0e76e6d975ac1c6fe8ed

SHA1
1fe3ce2e7dd452d584d86e64b4da01265bcf4cfb

SHA256
bbc4f76169b5b42e2e98011c0b6d6f977a64f727509ccbf1fec9eab6a55b35c3

SHA512
defa9002a0c2aa900f10d0d4ba0a2f76aef13f119a4deb18bd2fc417dd557a939e855cc1930152fa9cc3e5bb7e9724fcc765a81fd6cbcc92e10f106e039e2e0b

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
memory/316-324-0x0000000000000000-mapping.dmp

Download
memory/524-363-0x0000000000000000-mapping.dmp

Download
memory/560-275-0x0000000000000000-mapping.dmp

Download
memory/576-218-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/576-214-0x0000000000000000-mapping.dmp

Download
memory/576-219-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/576-283-0x0000000000000000-mapping.dmp

Download
memory/580-247-0x0000000000000000-mapping.dmp

Download
memory/588-299-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/588-327-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/588-268-0x0000000000000000-mapping.dmp

Download
memory/592-198-0x0000000000000000-mapping.dmp

Download
memory/604-64-0x0000000000000000-mapping.dmp

Download
memory/608-204-0x0000000000000000-mapping.dmp

Download
memory/612-227-0x0000000000000000-mapping.dmp

Download
memory/636-112-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/636-389-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/636-74-0x0000000000000000-mapping.dmp

Download
memory/756-285-0x0000000000000000-mapping.dmp

Download
memory/768-197-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/768-270-0x0000000000000000-mapping.dmp

Download
memory/768-190-0x0000000000000000-mapping.dmp

Download
memory/768-391-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/772-345-0x0000000000000000-mapping.dmp

Download
memory/772-353-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/772-352-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/832-210-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/832-351-0x00000000002B0000-0x00000000002D9000-memory.dmp

Filesize
164KB

Download
memory/832-332-0x0000000000000000-mapping.dmp

Download
memory/832-207-0x0000000000000000-mapping.dmp

Download
memory/864-234-0x0000000000000000-mapping.dmp

Download
memory/872-102-0x0000000000000000-mapping.dmp

Download
memory/896-342-0x0000000000000000-mapping.dmp

Download
memory/900-179-0x0000000000250000-0x0000000000279000-memory.dmp

Filesize
164KB

Download
memory/900-180-0x0000000000250000-0x0000000000279000-memory.dmp

Filesize
164KB

Download
memory/900-233-0x0000000000250000-0x0000000000279000-memory.dmp

Filesize
164KB

Download
memory/900-165-0x0000000000000000-mapping.dmp

Download
memory/900-369-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-220-0x0000000000000000-mapping.dmp

Download
memory/936-142-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/936-143-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/936-115-0x0000000000000000-mapping.dmp

Download
memory/936-231-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/936-232-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/948-237-0x0000000000000000-mapping.dmp

Download
memory/1000-374-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1028-316-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1028-223-0x0000000000000000-mapping.dmp

Download
memory/1028-226-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1036-236-0x0000000000000000-mapping.dmp

Download
memory/1036-157-0x0000000000000000-mapping.dmp

Download
memory/1036-162-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1072-297-0x00000000003C0000-0x00000000003E9000-memory.dmp

Filesize
164KB

Download
memory/1072-282-0x0000000000000000-mapping.dmp

Download
memory/1092-281-0x0000000000000000-mapping.dmp

Download
memory/1156-86-0x0000000000000000-mapping.dmp

Download
memory/1192-274-0x0000000000000000-mapping.dmp

Download
memory/1192-328-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1272-111-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1272-390-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1272-58-0x0000000000000000-mapping.dmp

Download
memory/1280-303-0x0000000000000000-mapping.dmp

Download
memory/1280-344-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1296-277-0x00000000003B0000-0x00000000003D9000-memory.dmp

Filesize
164KB

Download
memory/1296-235-0x0000000000000000-mapping.dmp

Download
memory/1296-298-0x00000000003B0000-0x00000000003D9000-memory.dmp

Filesize
164KB

Download
memory/1344-145-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1344-146-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1344-137-0x0000000000000000-mapping.dmp

Download
memory/1428-110-0x0000000000290000-0x00000000002B9000-memory.dmp

Filesize
164KB

Download
memory/1428-109-0x0000000000290000-0x00000000002B9000-memory.dmp

Filesize
164KB

Download
memory/1448-144-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1448-123-0x0000000000000000-mapping.dmp

Download
memory/1448-388-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1512-173-0x0000000000000000-mapping.dmp

Download
memory/1528-290-0x0000000000000000-mapping.dmp

Download
memory/1544-333-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1544-243-0x0000000000000000-mapping.dmp

Download
memory/1544-289-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-360-0x0000000000000000-mapping.dmp

Download
memory/1592-355-0x0000000000000000-mapping.dmp

Download
memory/1608-288-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1608-242-0x0000000000000000-mapping.dmp

Download
memory/1608-246-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1608-337-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1652-280-0x0000000000250000-0x0000000000279000-memory.dmp

Filesize
164KB

Download
memory/1652-229-0x0000000000000000-mapping.dmp

Download
memory/1664-284-0x0000000000000000-mapping.dmp

Download
memory/1664-211-0x0000000000000000-mapping.dmp

Download
memory/1720-187-0x0000000000000000-mapping.dmp

Download
memory/1720-279-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1720-336-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1720-262-0x0000000000000000-mapping.dmp

Download
memory/1744-193-0x0000000000000000-mapping.dmp

Download
memory/1744-196-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1748-278-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1748-261-0x0000000000000000-mapping.dmp

Download
memory/1748-335-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1752-245-0x0000000000240000-0x0000000000269000-memory.dmp

Filesize
164KB

Download
memory/1752-230-0x0000000000000000-mapping.dmp

Download
memory/1752-130-0x0000000000000000-mapping.dmp

Download
memory/1752-287-0x0000000000240000-0x0000000000269000-memory.dmp

Filesize
164KB

Download
memory/1780-99-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1780-94-0x0000000000000000-mapping.dmp

Download
memory/1792-149-0x0000000000000000-mapping.dmp

Download
memory/1824-340-0x0000000000000000-mapping.dmp

Download
memory/1828-271-0x0000000000000000-mapping.dmp

Download
memory/1828-338-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1836-334-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1836-294-0x0000000000000000-mapping.dmp

Download
memory/1884-244-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1884-286-0x0000000000230000-0x0000000000259000-memory.dmp

Filesize
164KB

Download
memory/1884-228-0x0000000000000000-mapping.dmp

Download
memory/1892-379-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1948-347-0x0000000000000000-mapping.dmp

Download
memory/1960-291-0x0000000000000000-mapping.dmp

Download
memory/1976-201-0x0000000000000000-mapping.dmp

Download
memory/1976-217-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-329-0x0000000074C41000-0x0000000074C43000-memory.dmp

Filesize
8KB

Download
memory/1984-184-0x0000000000000000-mapping.dmp

Download
memory/2012-170-0x0000000000000000-mapping.dmp

Download
memory/2012-181-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2012-392-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2040-176-0x0000000000000000-mapping.dmp

Download
memory/2040-182-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2040-183-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download