791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c

Analysis

max time kernel
169s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Size

205KB
MD5

4df6acbba6c22338c62f87efef265647
SHA1

fd0cc57766fed773ac1cea5c5e8c0f090a927817
SHA256

791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c
SHA512

f84e04c79e36f42a46ac2d9cb50ed0834852155c6a9e514f4fcf3a3bf9bc7fd74ef1a255075e5d81ed208d4f947ddd014feaf84d49281fbf785159fe159426b2
SSDEEP

3072:yqhMPktRhlARSOsdwD/98out3SDADeak7dJHB/AKG:yqhMPktRARoiSoS3SsQLH5AK

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

csrss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe winlogon.exe services.exe winlogon.exe services.exe lsass.exe smss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

lsass.exe services.exe hdsp.exewinlogon.exe smss.exe csrss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe winlogon.exe services.exe csrss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe

Modifies visibility of file extensions in Explorer 2 TTPs 10 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

csrss.exe winlogon.exe services.exe hdsp.exewinlogon.exe lsass.exe smss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe csrss.exeservices.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hdsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 10 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

lsass.exe csrss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe winlogon.exe csrss.exehdsp.exewinlogon.exe services.exe smss.exe services.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hdsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe

UAC bypass 3 TTPs 8 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

smss.exe csrss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe winlogon.exe services.exe winlogon.exe services.exe lsass.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe

Disables RegEdit via registry modification 8 IoCs

evasion

Processes:

services.exe winlogon.exe services.exe lsass.exe smss.exe csrss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 64 IoCs

Processes:

791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe csrss.execsrss.exe csrss.execsrss.exe hdsp.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe winlogon.exewinlogon.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe winlogon.exewinlogon.exe ~Paraysutki_VM_Community~~Paraysutki_VM_Community~winlogon.exewinlogon.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exeservices.exe lsass.exesmss.exe~Paraysutki_VM_Community~winlogon.exeservices.exe lsass.exe services.exelsass.exewinlogon.exe

pid	process
1732	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
604	csrss.exe
1464	csrss.exe
1712	csrss.exe
792	csrss.exe
1632	hdsp.exe
1860	smss.exe
1260	smss.exe
732	csrss.exe
1716	csrss.exe
1928	smss.exe
1104	smss.exe
2008	lsass.exe
876	lsass.exe
976	csrss.exe
1548	csrss.exe
1320	smss.exe
1704	smss.exe
1620	lsass.exe
1824	lsass.exe
1200	services.exe
1544	services.exe
268	csrss.exe
964	csrss.exe
2000	smss.exe
1532	smss.exe
1712	lsass.exe
1556	lsass.exe
1940	services.exe
1288	services.exe
816	winlogon.exe
836	winlogon.exe
1716	csrss.exe
788	csrss.exe
552	smss.exe
920	smss.exe
1648	lsass.exe
1076	lsass.exe
936	services.exe
1548	services.exe
1460	winlogon.exe
1608	winlogon.exe
1976	~Paraysutki_VM_Community~
1780	~Paraysutki_VM_Community~
1104	winlogon.exe
1764	winlogon.exe
1124	csrss.exe
1512	csrss.exe
852	smss.exe
1760	smss.exe
552	lsass.exe
884	lsass.exe
1788	services.exe
1072	services.exe
1508	services.exe
1160	lsass.exe
1756	smss.exe
612	~Paraysutki_VM_Community~
1392	winlogon.exe
1928	services.exe
324	lsass.exe
1552	services.exe
1004	lsass.exe
1740	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

services.exe csrss.exe winlogon.exe services.exe winlogon.exe lsass.exe smss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe\Debugger = "cmd.exe /c del"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe\Debugger = "cmd.exe /c del"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	services.exe

Loads dropped DLL 64 IoCs

Processes:

pid	process
1340	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
1340	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
1732	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
1732	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
604	csrss.exe
604	csrss.exe
604	csrss.exe
1464	csrss.exe
1464	csrss.exe
1464	csrss.exe
1712	csrss.exe
1712	csrss.exe
792	csrss.exe
1712	csrss.exe
1712	csrss.exe
1464	csrss.exe
1464	csrss.exe
1860	smss.exe
1860	smss.exe
1860	smss.exe
1260	smss.exe
1260	smss.exe
1260	smss.exe
732	csrss.exe
732	csrss.exe
1716	csrss.exe
1260	smss.exe
1260	smss.exe
1928	smss.exe
1928	smss.exe
1104	smss.exe
1260	smss.exe
1260	smss.exe
2008	lsass.exe
2008	lsass.exe
2008	lsass.exe
876	lsass.exe
876	lsass.exe
876	lsass.exe
976	csrss.exe
976	csrss.exe
1548	csrss.exe
876	lsass.exe
876	lsass.exe
1320	smss.exe
1320	smss.exe
1704	smss.exe
876	lsass.exe
876	lsass.exe
1620	lsass.exe
1620	lsass.exe
1824	lsass.exe
876	lsass.exe
876	lsass.exe
1200	services.exe
1200	services.exe
1200	services.exe
1544	services.exe
1544	services.exe
1544	services.exe
268	csrss.exe
268	csrss.exe
964	csrss.exe
1544	services.exe

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winlogon.exe services.exe lsass.exe services.exe smss.exe csrss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe hdsp.exewinlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

winlogon.exe services.exe lsass.exe smss.exe csrss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe winlogon.exe services.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

hdsp.exe

description	ioc	process
File opened (read-only)	\??\Y:	hdsp.exe
File opened (read-only)	\??\H:	hdsp.exe
File opened (read-only)	\??\K:	hdsp.exe
File opened (read-only)	\??\N:	hdsp.exe
File opened (read-only)	\??\T:	hdsp.exe
File opened (read-only)	\??\X:	hdsp.exe
File opened (read-only)	\??\W:	hdsp.exe
File opened (read-only)	\??\B:	hdsp.exe
File opened (read-only)	\??\Q:	hdsp.exe
File opened (read-only)	\??\R:	hdsp.exe
File opened (read-only)	\??\S:	hdsp.exe
File opened (read-only)	\??\V:	hdsp.exe
File opened (read-only)	\??\E:	hdsp.exe
File opened (read-only)	\??\F:	hdsp.exe
File opened (read-only)	\??\J:	hdsp.exe
File opened (read-only)	\??\P:	hdsp.exe
File opened (read-only)	\??\U:	hdsp.exe
File opened (read-only)	\??\Z:	hdsp.exe
File opened (read-only)	\??\G:	hdsp.exe
File opened (read-only)	\??\I:	hdsp.exe
File opened (read-only)	\??\L:	hdsp.exe
File opened (read-only)	\??\M:	hdsp.exe
File opened (read-only)	\??\O:	hdsp.exe

Drops file in System32 directory 64 IoCs

Processes:

791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe csrss.exewinlogon.exe csrss.exelsass.exe~Paraysutki_VM_Community~smss.exe ~Paraysutki_VM_Community~services.exe csrss.exe lsass.exeservices.exe smss.exelsass.exelsass.exewinlogon.exe winlogon.exe~Paraysutki_VM_Community~~Paraysutki_VM_Community~smss.exeservices.exelsass.exe csrss.exesmss.exewinlogon.exewinlogon.exesmss.execsrss.exelsass.exe

description	ioc	process
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	lsass.exe

Drops file in Program Files directory 34 IoCs

Processes:

hdsp.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	hdsp.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	hdsp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

Processes:

winlogon.exe lsass.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe winlogon.exe smss.exe csrss.exe services.exe services.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe

Modifies registry class 52 IoCs

Processes:

csrss.exehdsp.exelsass.exe csrss.exe services.exe winlogon.exe smss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe winlogon.exe services.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	hdsp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	hdsp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	hdsp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	hdsp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	hdsp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	hdsp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe

Runs ping.exe 1 TTPs 24 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
2740	ping.exe
2760	ping.exe
924	ping.exe
2524	ping.exe
2148	ping.exe
1940	ping.exe
2448	ping.exe
2080	ping.exe
2184	ping.exe
2088	ping.exe
2544	ping.exe
2172	ping.exe
2688	ping.exe
268	ping.exe
1572	ping.exe
1060	ping.exe
2068	ping.exe
2536	ping.exe
2784	ping.exe
1760	ping.exe
540	ping.exe
1152	ping.exe
956	ping.exe
2672	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winlogon.exeservices.exe

pid	process
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
816	winlogon.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe
1200	services.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

pid process

2412 rundll32.exe
1992 rundll32.exe
2512 rundll32.exe
1132 rundll32.exe

pid	process
2412	rundll32.exe
1992	rundll32.exe
2512	rundll32.exe
1132	rundll32.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe csrss.execsrss.exe csrss.execsrss.exe hdsp.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe winlogon.exewinlogon.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe winlogon.exewinlogon.exe ~Paraysutki_VM_Community~~Paraysutki_VM_Community~winlogon.exewinlogon.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exeservices.exe lsass.exewinlogon.exeservices.exe winlogon.exe~Paraysutki_VM_Community~lsass.exe~Paraysutki_VM_Community~smss.exe

pid	process
1340	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
1732	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
604	csrss.exe
1464	csrss.exe
1712	csrss.exe
792	csrss.exe
1632	hdsp.exe
1860	smss.exe
1260	smss.exe
732	csrss.exe
1716	csrss.exe
1928	smss.exe
1104	smss.exe
2008	lsass.exe
876	lsass.exe
976	csrss.exe
1548	csrss.exe
1320	smss.exe
1704	smss.exe
1620	lsass.exe
1824	lsass.exe
1200	services.exe
1544	services.exe
268	csrss.exe
964	csrss.exe
2000	smss.exe
1532	smss.exe
1712	lsass.exe
1556	lsass.exe
1940	services.exe
1288	services.exe
816	winlogon.exe
836	winlogon.exe
1716	csrss.exe
788	csrss.exe
552	smss.exe
920	smss.exe
1648	lsass.exe
1076	lsass.exe
936	services.exe
1548	services.exe
1460	winlogon.exe
1608	winlogon.exe
1976	~Paraysutki_VM_Community~
1780	~Paraysutki_VM_Community~
1104	winlogon.exe
1764	winlogon.exe
1124	csrss.exe
1512	csrss.exe
852	smss.exe
1760	smss.exe
552	lsass.exe
884	lsass.exe
1788	services.exe
1072	services.exe
1508	services.exe
1160	lsass.exe
1392	winlogon.exe
1928	services.exe
1740	winlogon.exe
612	~Paraysutki_VM_Community~
1004	lsass.exe
1424	~Paraysutki_VM_Community~
1756	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 1340 wrote to memory of 1732	1340	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
PID 1340 wrote to memory of 1732	1340	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
PID 1340 wrote to memory of 1732	1340	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
PID 1340 wrote to memory of 1732	1340	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
PID 1732 wrote to memory of 604	1732	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe	csrss.exe
PID 1732 wrote to memory of 604	1732	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe	csrss.exe
PID 1732 wrote to memory of 604	1732	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe	csrss.exe
PID 1732 wrote to memory of 604	1732	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe	csrss.exe
PID 604 wrote to memory of 1464	604	csrss.exe	csrss.exe
PID 604 wrote to memory of 1464	604	csrss.exe	csrss.exe
PID 604 wrote to memory of 1464	604	csrss.exe	csrss.exe
PID 604 wrote to memory of 1464	604	csrss.exe	csrss.exe
PID 1464 wrote to memory of 1712	1464	csrss.exe	csrss.exe
PID 1464 wrote to memory of 1712	1464	csrss.exe	csrss.exe
PID 1464 wrote to memory of 1712	1464	csrss.exe	csrss.exe
PID 1464 wrote to memory of 1712	1464	csrss.exe	csrss.exe
PID 1712 wrote to memory of 792	1712	csrss.exe	csrss.exe
PID 1712 wrote to memory of 792	1712	csrss.exe	csrss.exe
PID 1712 wrote to memory of 792	1712	csrss.exe	csrss.exe
PID 1712 wrote to memory of 792	1712	csrss.exe	csrss.exe
PID 1712 wrote to memory of 1632	1712	csrss.exe	hdsp.exe
PID 1712 wrote to memory of 1632	1712	csrss.exe	hdsp.exe
PID 1712 wrote to memory of 1632	1712	csrss.exe	hdsp.exe
PID 1712 wrote to memory of 1632	1712	csrss.exe	hdsp.exe
PID 1464 wrote to memory of 1860	1464	csrss.exe	smss.exe
PID 1464 wrote to memory of 1860	1464	csrss.exe	smss.exe
PID 1464 wrote to memory of 1860	1464	csrss.exe	smss.exe
PID 1464 wrote to memory of 1860	1464	csrss.exe	smss.exe
PID 1860 wrote to memory of 1260	1860	smss.exe	smss.exe
PID 1860 wrote to memory of 1260	1860	smss.exe	smss.exe
PID 1860 wrote to memory of 1260	1860	smss.exe	smss.exe
PID 1860 wrote to memory of 1260	1860	smss.exe	smss.exe
PID 1260 wrote to memory of 732	1260	smss.exe	csrss.exe
PID 1260 wrote to memory of 732	1260	smss.exe	csrss.exe
PID 1260 wrote to memory of 732	1260	smss.exe	csrss.exe
PID 1260 wrote to memory of 732	1260	smss.exe	csrss.exe
PID 732 wrote to memory of 1716	732	csrss.exe	csrss.exe
PID 732 wrote to memory of 1716	732	csrss.exe	csrss.exe
PID 732 wrote to memory of 1716	732	csrss.exe	csrss.exe
PID 732 wrote to memory of 1716	732	csrss.exe	csrss.exe
PID 1260 wrote to memory of 1928	1260	smss.exe	smss.exe
PID 1260 wrote to memory of 1928	1260	smss.exe	smss.exe
PID 1260 wrote to memory of 1928	1260	smss.exe	smss.exe
PID 1260 wrote to memory of 1928	1260	smss.exe	smss.exe
PID 1928 wrote to memory of 1104	1928	smss.exe	smss.exe
PID 1928 wrote to memory of 1104	1928	smss.exe	smss.exe
PID 1928 wrote to memory of 1104	1928	smss.exe	smss.exe
PID 1928 wrote to memory of 1104	1928	smss.exe	smss.exe
PID 1260 wrote to memory of 2008	1260	smss.exe	lsass.exe
PID 1260 wrote to memory of 2008	1260	smss.exe	lsass.exe
PID 1260 wrote to memory of 2008	1260	smss.exe	lsass.exe
PID 1260 wrote to memory of 2008	1260	smss.exe	lsass.exe
PID 2008 wrote to memory of 876	2008	lsass.exe	lsass.exe
PID 2008 wrote to memory of 876	2008	lsass.exe	lsass.exe
PID 2008 wrote to memory of 876	2008	lsass.exe	lsass.exe
PID 2008 wrote to memory of 876	2008	lsass.exe	lsass.exe
PID 876 wrote to memory of 976	876	lsass.exe	csrss.exe
PID 876 wrote to memory of 976	876	lsass.exe	csrss.exe
PID 876 wrote to memory of 976	876	lsass.exe	csrss.exe
PID 876 wrote to memory of 976	876	lsass.exe	csrss.exe
PID 976 wrote to memory of 1548	976	csrss.exe	csrss.exe
PID 976 wrote to memory of 1548	976	csrss.exe	csrss.exe
PID 976 wrote to memory of 1548	976	csrss.exe	csrss.exe
PID 976 wrote to memory of 1548	976	csrss.exe	csrss.exe

System policy modification 1 TTPs 16 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exe services.exe lsass.exe csrss.exe 791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe winlogon.exe smss.exe services.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

C:\Users\Admin\AppData\Local\Temp\791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
"C:\Users\Admin\AppData\Local\Temp\791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Local\Temp\791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
C:\Users\Admin\AppData\Local\Temp\791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1732

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1464

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:792

\??\c:\Documents and Settings\Admin\Application Data\Microsoft\hdsp.exe
"c:\Documents and Settings\Admin\Application Data\Microsoft\hdsp.exe" csrss
6⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1632

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1260

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1104

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
8⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:876

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1704

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1824

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1200

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
10⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1544

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:268

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:964

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1556

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1940

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1288

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:816

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
12⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:836

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:788

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:552

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:920

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1076

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:936

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1608

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
13⤵
- Suspicious use of FindShellTrayWindow
PID:1992

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
13⤵
- Runs ping.exe
PID:1152

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
13⤵
- Runs ping.exe
PID:268

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
13⤵
- Runs ping.exe
PID:956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
13⤵
PID:304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
13⤵
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
13⤵
PID:1124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
13⤵
PID:1004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
13⤵
PID:1504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
13⤵
PID:1928

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
11⤵
- Suspicious use of FindShellTrayWindow
PID:1132

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1060

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1572

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
11⤵
- Runs ping.exe
PID:924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
11⤵
PID:1700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
11⤵
PID:1608

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
11⤵
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
11⤵
PID:1072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
11⤵
PID:1160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
11⤵
PID:1684

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1104

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
10⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1764

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1124

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1512

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1756

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
12⤵
PID:1496

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1004

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
12⤵
PID:1204

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
11⤵
PID:2276

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
12⤵
PID:2432

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
11⤵
PID:2984

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
12⤵
PID:1124

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
11⤵
PID:676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
11⤵
PID:2120

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1760

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
11⤵
PID:1756

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
11⤵
- Runs ping.exe
PID:2448

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
11⤵
PID:2612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
11⤵
PID:2772

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
9⤵
PID:936

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:2068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
9⤵
PID:2096

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
9⤵
- Runs ping.exe
PID:2088

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:2080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
9⤵
PID:2160

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
9⤵
PID:2316

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
9⤵
PID:2328

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
9⤵
PID:2344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
9⤵
PID:2380

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1788

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
8⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1508

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
9⤵
PID:2400

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
10⤵
PID:2492

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
9⤵
- Drops file in System32 directory
PID:2888

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
10⤵
PID:1740

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
9⤵
PID:3000

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
9⤵
PID:988

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
10⤵
PID:2624

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
9⤵
- Drops file in System32 directory
PID:2096

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
10⤵
PID:2920

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
9⤵
PID:1612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
9⤵
PID:2344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
9⤵
PID:2676

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
9⤵
- Runs ping.exe
PID:540

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:2688

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:2672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
9⤵
PID:836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
9⤵
PID:2496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
9⤵
PID:2960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
9⤵
PID:3028

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1392

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
8⤵
PID:1760

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
7⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
7⤵
- Suspicious use of FindShellTrayWindow
PID:2412

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
7⤵
- Runs ping.exe
PID:2544

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:2536

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:2524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
7⤵
PID:2552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
7⤵
PID:2600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
7⤵
PID:2612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
7⤵
PID:2640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
7⤵
PID:2660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
7⤵
PID:2676

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:552

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:884

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1072

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1928

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1740

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
6⤵
PID:1616

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
5⤵
- Drops file in System32 directory
PID:2284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
- Suspicious use of FindShellTrayWindow
PID:2512

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:2740

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:2760

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
5⤵
- Runs ping.exe
PID:2784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
5⤵
PID:2804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
5⤵
PID:2852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
5⤵
PID:2868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
5⤵
PID:2912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
5⤵
PID:3020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
5⤵
PID:3064

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:852

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1760

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1160

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
4⤵
- Executes dropped EXE
PID:324

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
3⤵
- Executes dropped EXE
PID:1552

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
4⤵
PID:540

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
3⤵
PID:2268

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
4⤵
PID:2368

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
3⤵
- Drops file in System32 directory
PID:2896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
3⤵
PID:3012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
3⤵
PID:2188

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
3⤵
- Runs ping.exe
PID:2184

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:2148

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:2172

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
3⤵
PID:2316

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
3⤵
PID:2352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
3⤵
PID:1424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
3⤵
PID:1616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
3⤵
PID:2872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\hdsp.exe

Filesize
76KB

MD5
f5dec43526a1344c2587ae739850c8ee

SHA1
d90ce81bd4f5e2c99c6026f7b38815b1dfc8d2a5

SHA256
cc5e4f94d86d5c704d2cac66f4a443e15eec4f6b47882e2034b4f5b805e68008

SHA512
73b02f305dc7fee969a4d39a5cbbad1adfa21f4d53589fcc33c5d04529ea1d44278a8b88fb515b5a350502ef25944af3171ffe66c2d000a4630ce12745135a50

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe

Filesize
205KB

MD5
82d8b0929b29136acc3f241f343c2c11

SHA1
b4bb6460729b831da6a0623a95bbce5a2add76aa

SHA256
07f947c71edd32d8d4944d1051bf14271df98d6f0f5a37b8bbec140894015f20

SHA512
2106ba228b6588b1b89ae3bdca8e905ca0564659d54d838cb1a953f668c057dd4dbbcfaa5a49bdc2cb8956cb27bab4a17d75bb9350b44a2c604c8fa6f5c2abdc

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe

Filesize
205KB

MD5
82d8b0929b29136acc3f241f343c2c11

SHA1
b4bb6460729b831da6a0623a95bbce5a2add76aa

SHA256
07f947c71edd32d8d4944d1051bf14271df98d6f0f5a37b8bbec140894015f20

SHA512
2106ba228b6588b1b89ae3bdca8e905ca0564659d54d838cb1a953f668c057dd4dbbcfaa5a49bdc2cb8956cb27bab4a17d75bb9350b44a2c604c8fa6f5c2abdc

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~

Filesize
205KB

MD5
82d8b0929b29136acc3f241f343c2c11

SHA1
b4bb6460729b831da6a0623a95bbce5a2add76aa

SHA256
07f947c71edd32d8d4944d1051bf14271df98d6f0f5a37b8bbec140894015f20

SHA512
2106ba228b6588b1b89ae3bdca8e905ca0564659d54d838cb1a953f668c057dd4dbbcfaa5a49bdc2cb8956cb27bab4a17d75bb9350b44a2c604c8fa6f5c2abdc

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\hdsp.exe

Filesize
76KB

MD5
f5dec43526a1344c2587ae739850c8ee

SHA1
d90ce81bd4f5e2c99c6026f7b38815b1dfc8d2a5

SHA256
cc5e4f94d86d5c704d2cac66f4a443e15eec4f6b47882e2034b4f5b805e68008

SHA512
73b02f305dc7fee969a4d39a5cbbad1adfa21f4d53589fcc33c5d04529ea1d44278a8b88fb515b5a350502ef25944af3171ffe66c2d000a4630ce12745135a50

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
\Users\Admin\AppData\Local\Temp\791ab6e7a3087b1137cc26fca64b8101ed1400f879ef55a2bafa95252567d41c.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\hdsp.exe

Filesize
76KB

MD5
f5dec43526a1344c2587ae739850c8ee

SHA1
d90ce81bd4f5e2c99c6026f7b38815b1dfc8d2a5

SHA256
cc5e4f94d86d5c704d2cac66f4a443e15eec4f6b47882e2034b4f5b805e68008

SHA512
73b02f305dc7fee969a4d39a5cbbad1adfa21f4d53589fcc33c5d04529ea1d44278a8b88fb515b5a350502ef25944af3171ffe66c2d000a4630ce12745135a50

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\hdsp.exe

Filesize
76KB

MD5
f5dec43526a1344c2587ae739850c8ee

SHA1
d90ce81bd4f5e2c99c6026f7b38815b1dfc8d2a5

SHA256
cc5e4f94d86d5c704d2cac66f4a443e15eec4f6b47882e2034b4f5b805e68008

SHA512
73b02f305dc7fee969a4d39a5cbbad1adfa21f4d53589fcc33c5d04529ea1d44278a8b88fb515b5a350502ef25944af3171ffe66c2d000a4630ce12745135a50

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
778f1cd36f28324d9225f49931f94437

SHA1
761309d818b9f81ac440be06d1fbe50e38d33259

SHA256
72a4ac69128be32b7fd2c55be94af0b1ebfbcb3baa711e1f1fda18df19291361

SHA512
9aadd73a905ec9675acb2e025575f3b353fe21ef647567382a48af9efcace89e2c3c99f35b6cad488f0d059094d8dff566403bd983c43e05a0bb5ad9973db8d5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
d59dab168f6d22ec45489200a08df1c6

SHA1
cfe1f97f47c94669fc73c571550e74a4f4060b20

SHA256
2c4bcc046f784508407e18e79f31e116ae793667710b84876b4d8b001025f32f

SHA512
8302fef9f8e70e01e9914cc812ad5f6140f4e46f4f80fa60fba7aeb3f53e90bfa958be10b1ee0c3ac9801e46ba8774694895e701df8445a32a0bc7e9e19a386a

Download Submit
memory/268-281-0x0000000000000000-mapping.dmp

Download
memory/268-200-0x0000000000000000-mapping.dmp

Download
memory/304-285-0x0000000000000000-mapping.dmp

Download
memory/324-407-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/540-432-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/540-395-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/552-245-0x0000000000000000-mapping.dmp

Download
memory/604-64-0x0000000000000000-mapping.dmp

Download
memory/732-131-0x0000000000000000-mapping.dmp

Download
memory/788-238-0x0000000000000000-mapping.dmp

Download
memory/788-244-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/792-94-0x0000000000000000-mapping.dmp

Download
memory/792-103-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/816-228-0x0000000000000000-mapping.dmp

Download
memory/836-307-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/836-276-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/836-231-0x0000000000000000-mapping.dmp

Download
memory/836-242-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/852-353-0x0000000000240000-0x000000000026A000-memory.dmp

Filesize
168KB

Download
memory/852-332-0x0000000000240000-0x000000000026A000-memory.dmp

Filesize
168KB

Download
memory/876-168-0x0000000000000000-mapping.dmp

Download
memory/876-413-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/876-183-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/884-356-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/884-338-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/920-251-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/920-248-0x0000000000000000-mapping.dmp

Download
memory/924-304-0x0000000000000000-mapping.dmp

Download
memory/936-259-0x0000000000000000-mapping.dmp

Download
memory/956-283-0x0000000000000000-mapping.dmp

Download
memory/964-203-0x0000000000000000-mapping.dmp

Download
memory/964-206-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/976-171-0x0000000000000000-mapping.dmp

Download
memory/1004-294-0x0000000000000000-mapping.dmp

Download
memory/1004-391-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/1060-298-0x0000000000000000-mapping.dmp

Download
memory/1072-355-0x00000000003C0000-0x00000000003EA000-memory.dmp

Filesize
168KB

Download
memory/1072-316-0x0000000000000000-mapping.dmp

Download
memory/1076-255-0x0000000000000000-mapping.dmp

Download
memory/1076-258-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1104-160-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1104-155-0x0000000000000000-mapping.dmp

Download
memory/1104-300-0x0000000000000000-mapping.dmp

Download
memory/1104-324-0x0000000000300000-0x000000000032A000-memory.dmp

Filesize
168KB

Download
memory/1124-292-0x0000000000000000-mapping.dmp

Download
memory/1124-345-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1124-326-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1132-290-0x0000000000000000-mapping.dmp

Download
memory/1152-280-0x0000000000000000-mapping.dmp

Download
memory/1200-194-0x0000000000000000-mapping.dmp

Download
memory/1200-237-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1200-239-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1204-415-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1204-396-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1260-124-0x0000000000000000-mapping.dmp

Download
memory/1260-144-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1288-227-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1288-224-0x0000000000000000-mapping.dmp

Download
memory/1320-178-0x0000000000000000-mapping.dmp

Download
memory/1340-97-0x00000000022A0000-0x00000000022CA000-memory.dmp

Filesize
168KB

Download
memory/1340-95-0x00000000022A0000-0x00000000022CA000-memory.dmp

Filesize
168KB

Download
memory/1392-381-0x0000000000350000-0x000000000037A000-memory.dmp

Filesize
168KB

Download
memory/1460-266-0x0000000000000000-mapping.dmp

Download
memory/1464-100-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1464-74-0x0000000000000000-mapping.dmp

Download
memory/1496-403-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1496-394-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1504-296-0x0000000000000000-mapping.dmp

Download
memory/1508-342-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1508-359-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1512-327-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1512-346-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1532-210-0x0000000000000000-mapping.dmp

Download
memory/1532-213-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1544-197-0x0000000000000000-mapping.dmp

Download
memory/1544-240-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1548-265-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1548-177-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1548-174-0x0000000000000000-mapping.dmp

Download
memory/1548-262-0x0000000000000000-mapping.dmp

Download
memory/1556-217-0x0000000000000000-mapping.dmp

Download
memory/1556-220-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1572-301-0x0000000000000000-mapping.dmp

Download
memory/1608-269-0x0000000000000000-mapping.dmp

Download
memory/1608-272-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1608-310-0x0000000000000000-mapping.dmp

Download
memory/1616-424-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1620-187-0x0000000000000000-mapping.dmp

Download
memory/1632-106-0x0000000000000000-mapping.dmp

Download
memory/1648-252-0x0000000000000000-mapping.dmp

Download
memory/1700-306-0x0000000000000000-mapping.dmp

Download
memory/1704-181-0x0000000000000000-mapping.dmp

Download
memory/1704-185-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1704-186-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1712-86-0x0000000000000000-mapping.dmp

Download
memory/1712-113-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1712-214-0x0000000000000000-mapping.dmp

Download
memory/1716-234-0x0000000000000000-mapping.dmp

Download
memory/1716-143-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-138-0x0000000000000000-mapping.dmp

Download
memory/1732-99-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1732-58-0x0000000000000000-mapping.dmp

Download
memory/1740-387-0x00000000002B0000-0x00000000002DA000-memory.dmp

Filesize
168KB

Download
memory/1760-354-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1760-385-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1760-414-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1760-333-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1764-308-0x0000000000000000-mapping.dmp

Download
memory/1764-325-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1780-279-0x0000000000000000-mapping.dmp

Download
memory/1788-341-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1788-358-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1824-190-0x0000000000000000-mapping.dmp

Download
memory/1824-193-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1860-343-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1860-116-0x0000000000000000-mapping.dmp

Download
memory/1928-299-0x0000000000000000-mapping.dmp

Download
memory/1928-427-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1928-147-0x0000000000000000-mapping.dmp

Download
memory/1940-221-0x0000000000000000-mapping.dmp

Download
memory/1976-273-0x0000000000000000-mapping.dmp

Download
memory/1992-277-0x0000000000000000-mapping.dmp

Download
memory/2000-207-0x0000000000000000-mapping.dmp

Download
memory/2008-344-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/2008-163-0x0000000000000000-mapping.dmp

Download
memory/2036-287-0x0000000000000000-mapping.dmp

Download
memory/2040-314-0x0000000000000000-mapping.dmp

Download
memory/2368-435-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2492-434-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download