dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e

Analysis

max time kernel
152s
max time network
145s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Size

205KB
MD5

7d6d340475a4877e7c145d0719eb6e83
SHA1

c7a35eff846c0d9690a8375414a28ffa62cbf776
SHA256

dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e
SHA512

3f72ddf3ae043ee392958d254cf0b64b6c686e0b13f5bcd6fc301d4ca743a76bc31c31a4d841e1ff15574c500acbc942a5a192ac742322a4b9cc45c94ef227ed
SSDEEP

3072:kqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:kqhMPssRARoiSoS3SsQLH5AK

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

lsass.exe smss.exe csrss.exe services.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	winlogon.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe winlogon.exe csrss.exeduxp.exelsass.exe smss.exe csrss.exe services.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	duxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe

Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

csrss.exe services.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe winlogon.exe csrss.exeduxp.exelsass.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	duxp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

csrss.exe services.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe winlogon.exe csrss.exeduxp.exelsass.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	duxp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe winlogon.exe lsass.exe smss.exe csrss.exe services.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

winlogon.exe lsass.exe smss.exe csrss.exe services.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 64 IoCs

Processes:

dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe csrss.execsrss.exe csrss.execsrss.exe duxp.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe smss.exelsass.exeservices.exelsass.exesmss.exe winlogon.exeservices.exelsass.exewinlogon.exeservices.exelsass.exe winlogon.exe winlogon.exe lsass.exe services.exe services.exe services.exewinlogon.exewinlogon.exe~Paraysutki_VM_Community~~Paraysutki_VM_Community~winlogon.exe~Paraysutki_VM_Community~~Paraysutki_VM_Community~~Paraysutki_VM_Community~services.exe winlogon.exe csrss.exewinlogon.exe smss.exewinlogon.exe lsass.exeservices.exe smss.exe lsass.exe csrss.exe services.exeservices.exe

pid	process
656	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
304	csrss.exe
884	csrss.exe
1752	csrss.exe
1168	csrss.exe
2016	duxp.exe
2020	smss.exe
340	smss.exe
836	csrss.exe
948	csrss.exe
1492	smss.exe
1724	smss.exe
1756	lsass.exe
952	lsass.exe
1120	csrss.exe
1596	csrss.exe
816	smss.exe
1116	smss.exe
320	lsass.exe
620	lsass.exe
864	services.exe
1940	services.exe
1144	csrss.exe
1416	csrss.exe
1976	smss.exe
1328	smss.exe
784	smss.exe
112	lsass.exe
1720	services.exe
1740	lsass.exe
1868	smss.exe
1488	winlogon.exe
728	services.exe
824	lsass.exe
328	winlogon.exe
1288	services.exe
1724	lsass.exe
1532	winlogon.exe
1764	winlogon.exe
1928	lsass.exe
572	services.exe
556	services.exe
1836	services.exe
1364	winlogon.exe
1612	winlogon.exe
676	~Paraysutki_VM_Community~
1416	~Paraysutki_VM_Community~
1696	winlogon.exe
1540	~Paraysutki_VM_Community~
1104	~Paraysutki_VM_Community~
1552	~Paraysutki_VM_Community~
816	services.exe
1464	winlogon.exe
908	csrss.exe
868	winlogon.exe
1664	smss.exe
1528	winlogon.exe
1116	lsass.exe
2156	services.exe
2148	smss.exe
2456	lsass.exe
2644	csrss.exe
2732	services.exe
2856	services.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

services.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe lsass.exe smss.exe csrss.exe winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	smss.exe

Loads dropped DLL 64 IoCs

Processes:

pid	process
1336	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
1336	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
656	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
656	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
884	csrss.exe
884	csrss.exe
884	csrss.exe
1752	csrss.exe
1752	csrss.exe
1168	csrss.exe
1752	csrss.exe
1752	csrss.exe
884	csrss.exe
884	csrss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
340	smss.exe
340	smss.exe
340	smss.exe
836	csrss.exe
836	csrss.exe
948	csrss.exe
340	smss.exe
340	smss.exe
1492	smss.exe
1492	smss.exe
1724	smss.exe
340	smss.exe
340	smss.exe
1756	lsass.exe
1756	lsass.exe
1756	lsass.exe
952	lsass.exe
952	lsass.exe
952	lsass.exe
1120	csrss.exe
1120	csrss.exe
1596	csrss.exe
952	lsass.exe
952	lsass.exe
816	smss.exe
816	smss.exe
1116	smss.exe
952	lsass.exe
952	lsass.exe
320	lsass.exe
320	lsass.exe
620	lsass.exe
952	lsass.exe
952	lsass.exe
864	services.exe
864	services.exe
864	services.exe
1940	services.exe
1940	services.exe
1940	services.exe
1144	csrss.exe
1144	csrss.exe
1416	csrss.exe
1940	services.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

smss.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe lsass.exe csrss.exe winlogon.exe services.exe duxp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	duxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	duxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

lsass.exe smss.exe csrss.exe services.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe winlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

duxp.exe

description	ioc	process
File opened (read-only)	\??\V:	duxp.exe
File opened (read-only)	\??\X:	duxp.exe
File opened (read-only)	\??\J:	duxp.exe
File opened (read-only)	\??\L:	duxp.exe
File opened (read-only)	\??\N:	duxp.exe
File opened (read-only)	\??\O:	duxp.exe
File opened (read-only)	\??\Q:	duxp.exe
File opened (read-only)	\??\R:	duxp.exe
File opened (read-only)	\??\S:	duxp.exe
File opened (read-only)	\??\U:	duxp.exe
File opened (read-only)	\??\F:	duxp.exe
File opened (read-only)	\??\G:	duxp.exe
File opened (read-only)	\??\I:	duxp.exe
File opened (read-only)	\??\Z:	duxp.exe
File opened (read-only)	\??\B:	duxp.exe
File opened (read-only)	\??\K:	duxp.exe
File opened (read-only)	\??\M:	duxp.exe
File opened (read-only)	\??\T:	duxp.exe
File opened (read-only)	\??\W:	duxp.exe
File opened (read-only)	\??\Y:	duxp.exe
File opened (read-only)	\??\E:	duxp.exe
File opened (read-only)	\??\H:	duxp.exe
File opened (read-only)	\??\P:	duxp.exe

Drops file in System32 directory 64 IoCs

Processes:

winlogon.exe ~Paraysutki_VM_Community~lsass.exe winlogon.execsrss.exe services.exedd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe services.exe ~Paraysutki_VM_Community~smss.exe duxp.exedd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exesmss.execsrss.execsrss.execsrss.execsrss.execsrss.exelsass.exesmss.exewinlogon.exelsass.exeservices.exesmss.exewinlogon.exe~Paraysutki_VM_Community~lsass.exe~Paraysutki_VM_Community~

description	ioc	process
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	csrss.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	duxp.exe
File created	\??\c:\windows\SysWOW64\maxtrox.txt	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	smss.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	duxp.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	duxp.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~

Drops file in Program Files directory 34 IoCs

Processes:

duxp.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	duxp.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	duxp.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	duxp.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	duxp.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	duxp.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	duxp.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

lsass.exe smss.exe csrss.exe services.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	services.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	winlogon.exe

Modifies registry class 48 IoCs

Processes:

csrss.exeduxp.exelsass.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe smss.exe csrss.exe services.exe winlogon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	duxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	duxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	duxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	duxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	duxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	duxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	duxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	csrss.exe

Runs ping.exe 1 TTPs 18 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
1784	ping.exe
2304	ping.exe
3024	ping.exe
1760	ping.exe
2072	ping.exe
3004	ping.exe
2296	ping.exe
3016	ping.exe
1080	ping.exe
1752	ping.exe
2280	ping.exe
1888	ping.exe
1096	ping.exe
1668	ping.exe
2064	ping.exe
920	ping.exe
748	ping.exe
1308	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exesmss.exelsass.exe

pid	process
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
304	csrss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
2020	smss.exe
1756	lsass.exe
1756	lsass.exe
1756	lsass.exe
1756	lsass.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exedd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe csrss.execsrss.exe csrss.execsrss.exe duxp.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe smss.exelsass.exewinlogon.exesmss.exe lsass.exelsass.exe winlogon.exelsass.exeservices.exeservices.exewinlogon.exe winlogon.exe lsass.exe services.exe services.exe services.exe~Paraysutki_VM_Community~winlogon.exewinlogon.exewinlogon.exe~Paraysutki_VM_Community~~Paraysutki_VM_Community~~Paraysutki_VM_Community~winlogon.exe winlogon.exe ~Paraysutki_VM_Community~smss.exeservices.exe services.exelsass.exewinlogon.exe csrss.exeservices.exe lsass.exe smss.exe csrss.exe services.exe

pid	process
1336	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
656	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
304	csrss.exe
884	csrss.exe
1752	csrss.exe
1168	csrss.exe
2016	duxp.exe
2020	smss.exe
340	smss.exe
836	csrss.exe
948	csrss.exe
1492	smss.exe
1724	smss.exe
1756	lsass.exe
952	lsass.exe
1120	csrss.exe
1596	csrss.exe
816	smss.exe
1116	smss.exe
320	lsass.exe
620	lsass.exe
864	services.exe
1940	services.exe
1144	csrss.exe
1416	csrss.exe
1976	smss.exe
1328	smss.exe
784	smss.exe
1740	lsass.exe
1488	winlogon.exe
1868	smss.exe
824	lsass.exe
1724	lsass.exe
328	winlogon.exe
112	lsass.exe
1288	services.exe
728	services.exe
1532	winlogon.exe
1764	winlogon.exe
1928	lsass.exe
572	services.exe
556	services.exe
1836	services.exe
676	~Paraysutki_VM_Community~
1696	winlogon.exe
1364	winlogon.exe
1612	winlogon.exe
1104	~Paraysutki_VM_Community~
1416	~Paraysutki_VM_Community~
1540	~Paraysutki_VM_Community~
868	winlogon.exe
1464	winlogon.exe
1552	~Paraysutki_VM_Community~
1664	smss.exe
816	services.exe
1720	services.exe
1116	lsass.exe
1528	winlogon.exe
908	csrss.exe
2156	services.exe
2456	lsass.exe
2148	smss.exe
2644	csrss.exe
2732	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 1336 wrote to memory of 656	1336	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
PID 1336 wrote to memory of 656	1336	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
PID 1336 wrote to memory of 656	1336	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
PID 1336 wrote to memory of 656	1336	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
PID 656 wrote to memory of 304	656	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe	csrss.exe
PID 656 wrote to memory of 304	656	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe	csrss.exe
PID 656 wrote to memory of 304	656	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe	csrss.exe
PID 656 wrote to memory of 304	656	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe	csrss.exe
PID 304 wrote to memory of 884	304	csrss.exe	csrss.exe
PID 304 wrote to memory of 884	304	csrss.exe	csrss.exe
PID 304 wrote to memory of 884	304	csrss.exe	csrss.exe
PID 304 wrote to memory of 884	304	csrss.exe	csrss.exe
PID 884 wrote to memory of 1752	884	csrss.exe	csrss.exe
PID 884 wrote to memory of 1752	884	csrss.exe	csrss.exe
PID 884 wrote to memory of 1752	884	csrss.exe	csrss.exe
PID 884 wrote to memory of 1752	884	csrss.exe	csrss.exe
PID 1752 wrote to memory of 1168	1752	csrss.exe	csrss.exe
PID 1752 wrote to memory of 1168	1752	csrss.exe	csrss.exe
PID 1752 wrote to memory of 1168	1752	csrss.exe	csrss.exe
PID 1752 wrote to memory of 1168	1752	csrss.exe	csrss.exe
PID 1752 wrote to memory of 2016	1752	csrss.exe	duxp.exe
PID 1752 wrote to memory of 2016	1752	csrss.exe	duxp.exe
PID 1752 wrote to memory of 2016	1752	csrss.exe	duxp.exe
PID 1752 wrote to memory of 2016	1752	csrss.exe	duxp.exe
PID 884 wrote to memory of 2020	884	csrss.exe	smss.exe
PID 884 wrote to memory of 2020	884	csrss.exe	smss.exe
PID 884 wrote to memory of 2020	884	csrss.exe	smss.exe
PID 884 wrote to memory of 2020	884	csrss.exe	smss.exe
PID 2020 wrote to memory of 340	2020	smss.exe	smss.exe
PID 2020 wrote to memory of 340	2020	smss.exe	smss.exe
PID 2020 wrote to memory of 340	2020	smss.exe	smss.exe
PID 2020 wrote to memory of 340	2020	smss.exe	smss.exe
PID 340 wrote to memory of 836	340	smss.exe	csrss.exe
PID 340 wrote to memory of 836	340	smss.exe	csrss.exe
PID 340 wrote to memory of 836	340	smss.exe	csrss.exe
PID 340 wrote to memory of 836	340	smss.exe	csrss.exe
PID 836 wrote to memory of 948	836	csrss.exe	csrss.exe
PID 836 wrote to memory of 948	836	csrss.exe	csrss.exe
PID 836 wrote to memory of 948	836	csrss.exe	csrss.exe
PID 836 wrote to memory of 948	836	csrss.exe	csrss.exe
PID 340 wrote to memory of 1492	340	smss.exe	smss.exe
PID 340 wrote to memory of 1492	340	smss.exe	smss.exe
PID 340 wrote to memory of 1492	340	smss.exe	smss.exe
PID 340 wrote to memory of 1492	340	smss.exe	smss.exe
PID 1492 wrote to memory of 1724	1492	smss.exe	smss.exe
PID 1492 wrote to memory of 1724	1492	smss.exe	smss.exe
PID 1492 wrote to memory of 1724	1492	smss.exe	smss.exe
PID 1492 wrote to memory of 1724	1492	smss.exe	smss.exe
PID 340 wrote to memory of 1756	340	smss.exe	lsass.exe
PID 340 wrote to memory of 1756	340	smss.exe	lsass.exe
PID 340 wrote to memory of 1756	340	smss.exe	lsass.exe
PID 340 wrote to memory of 1756	340	smss.exe	lsass.exe
PID 1756 wrote to memory of 952	1756	lsass.exe	lsass.exe
PID 1756 wrote to memory of 952	1756	lsass.exe	lsass.exe
PID 1756 wrote to memory of 952	1756	lsass.exe	lsass.exe
PID 1756 wrote to memory of 952	1756	lsass.exe	lsass.exe
PID 952 wrote to memory of 1120	952	lsass.exe	csrss.exe
PID 952 wrote to memory of 1120	952	lsass.exe	csrss.exe
PID 952 wrote to memory of 1120	952	lsass.exe	csrss.exe
PID 952 wrote to memory of 1120	952	lsass.exe	csrss.exe
PID 1120 wrote to memory of 1596	1120	csrss.exe	csrss.exe
PID 1120 wrote to memory of 1596	1120	csrss.exe	csrss.exe
PID 1120 wrote to memory of 1596	1120	csrss.exe	csrss.exe
PID 1120 wrote to memory of 1596	1120	csrss.exe	csrss.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

lsass.exe csrss.exe services.exe dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe winlogon.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
"C:\Users\Admin\AppData\Local\Temp\dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Temp\dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
C:\Users\Admin\AppData\Local\Temp\dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:656

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:304

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:884

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1168

\??\c:\Documents and Settings\Admin\Application Data\Microsoft\duxp.exe
"c:\Documents and Settings\Admin\Application Data\Microsoft\duxp.exe" csrss
6⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:340

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:948

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
8⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:952

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1596

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:816

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:320

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:620

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:864

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
10⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1940

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1144

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1416

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1328

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1740

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1288

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:572

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1364

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:868

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
11⤵
PID:900

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:920

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1752

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
11⤵
- Runs ping.exe
PID:1308

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
11⤵
PID:1492

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
11⤵
PID:1116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
11⤵
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
11⤵
PID:768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
11⤵
PID:1960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
11⤵
PID:1988

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
10⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1532

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:908

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2644

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2456

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2732

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
12⤵
- Executes dropped EXE
PID:2856

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
11⤵
PID:2900

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
12⤵
PID:2920

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
11⤵
PID:2940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
11⤵
PID:2960

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
11⤵
- Runs ping.exe
PID:3024

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:3016

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:3004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
11⤵
PID:3032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
11⤵
PID:3068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
11⤵
PID:112

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
9⤵
PID:1408

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:1784

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:748

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
9⤵
- Runs ping.exe
PID:1080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
9⤵
PID:1976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
9⤵
PID:1692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
9⤵
PID:1976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
9⤵
PID:1932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
9⤵
PID:1760

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
9⤵
PID:1744

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1720

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:328

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1764

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
7⤵
PID:2024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
7⤵
PID:1744

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
7⤵
- Runs ping.exe
PID:1888

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1096

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
7⤵
PID:1960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
7⤵
PID:1744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
7⤵
PID:1288

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
7⤵
PID:1744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
7⤵
PID:1504

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:112

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1928

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:728

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:556

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1612

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1104

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
PID:612

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:1760

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
5⤵
- Runs ping.exe
PID:2072

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:2064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
5⤵
PID:2132

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
5⤵
PID:2228

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
5⤵
PID:2388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
5⤵
PID:2420

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
5⤵
PID:2560

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
5⤵
PID:2576

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:784

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:824

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1836

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:816

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1696

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1464

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
3⤵
PID:1816

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:2280

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:2296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
3⤵
PID:2320

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
3⤵
- Runs ping.exe
PID:2304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
3⤵
PID:2368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
3⤵
PID:2484

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
3⤵
PID:2552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
3⤵
PID:2584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
3⤵
PID:2604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\duxp.exe

Filesize
76KB

MD5
e90037b9a04dd35f2f863cf7cb7aefc5

SHA1
f5473a74949b700865311b4485e9a6126f18ecab

SHA256
4c70b279075c4fe6c5381680c2d9956fcc7092e8e27610a4a48848b7054feb99

SHA512
2f95f22d6715bd76bbf480c55ddec26aad1a254b11c32199b1c858cc1aa6382f3560d87e5ee800e2e1b42507247b6492dc68cdda3c05e91b80e28a762958aeb3

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\duxp.exe

Filesize
76KB

MD5
e90037b9a04dd35f2f863cf7cb7aefc5

SHA1
f5473a74949b700865311b4485e9a6126f18ecab

SHA256
4c70b279075c4fe6c5381680c2d9956fcc7092e8e27610a4a48848b7054feb99

SHA512
2f95f22d6715bd76bbf480c55ddec26aad1a254b11c32199b1c858cc1aa6382f3560d87e5ee800e2e1b42507247b6492dc68cdda3c05e91b80e28a762958aeb3

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
fe05ae356796324e4a970b7560c6ce0a

SHA1
f2a8c38f6d53a597362ff9e622a4f05cf47e0678

SHA256
90c9dc2a7e07ed026155285cbdb4c4039325263a260dd539a21f45a3bfcd0637

SHA512
aa130f34cc6b0dc8fa7d5ae3d51c9d0ee089214ba07962696195bb9b74851bd239cfab63a516c34d9ff72b3e65dc8b464167069bd38d75f699e0395005d3b193

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Users\Admin\AppData\Local\Temp\dd3742899616c5201cd8b3ff7140e563ee1169a168de9eba82c68ddcda3f8b3e.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\duxp.exe

Filesize
76KB

MD5
e90037b9a04dd35f2f863cf7cb7aefc5

SHA1
f5473a74949b700865311b4485e9a6126f18ecab

SHA256
4c70b279075c4fe6c5381680c2d9956fcc7092e8e27610a4a48848b7054feb99

SHA512
2f95f22d6715bd76bbf480c55ddec26aad1a254b11c32199b1c858cc1aa6382f3560d87e5ee800e2e1b42507247b6492dc68cdda3c05e91b80e28a762958aeb3

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\duxp.exe

Filesize
76KB

MD5
e90037b9a04dd35f2f863cf7cb7aefc5

SHA1
f5473a74949b700865311b4485e9a6126f18ecab

SHA256
4c70b279075c4fe6c5381680c2d9956fcc7092e8e27610a4a48848b7054feb99

SHA512
2f95f22d6715bd76bbf480c55ddec26aad1a254b11c32199b1c858cc1aa6382f3560d87e5ee800e2e1b42507247b6492dc68cdda3c05e91b80e28a762958aeb3

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ef0970572532cd35a8290657e3741fa6

SHA1
f5408c37f5024aad0538565641c7e46106156dd6

SHA256
0e09ec9a164a03a9aabe0e4595461b21b6aefb306e07ec745f35828f4e664fae

SHA512
25ff213861d8b53e15714f648428fcd6a7c9936084d47ea86dce279f3487682d62ca28068b535ed6538901aac7c795b920bd4b7054a68e4444933b3d4da40375

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
memory/112-290-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download
memory/112-220-0x0000000000000000-mapping.dmp

Download
memory/112-265-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download
memory/304-64-0x0000000000000000-mapping.dmp

Download
memory/320-190-0x0000000000000000-mapping.dmp

Download
memory/328-292-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download
memory/328-291-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download
memory/328-234-0x0000000000000000-mapping.dmp

Download
memory/328-266-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download
memory/340-131-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/340-224-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/340-389-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/340-125-0x0000000000000000-mapping.dmp

Download
memory/556-299-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/556-260-0x0000000000000000-mapping.dmp

Download
memory/556-369-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/572-259-0x0000000000000000-mapping.dmp

Download
memory/572-298-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/612-316-0x0000000000000000-mapping.dmp

Download
memory/620-196-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/620-193-0x0000000000000000-mapping.dmp

Download
memory/656-58-0x0000000000000000-mapping.dmp

Download
memory/656-99-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/676-284-0x0000000000000000-mapping.dmp

Download
memory/728-268-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/728-297-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/728-231-0x0000000000000000-mapping.dmp

Download
memory/748-332-0x0000000000000000-mapping.dmp

Download
memory/784-279-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/784-219-0x0000000000000000-mapping.dmp

Download
memory/816-329-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/816-183-0x0000000000000000-mapping.dmp

Download
memory/816-326-0x0000000000000000-mapping.dmp

Download
memory/824-233-0x0000000000000000-mapping.dmp

Download
memory/836-134-0x0000000000000000-mapping.dmp

Download
memory/864-216-0x0000000000370000-0x000000000039A000-memory.dmp

Filesize
168KB

Download
memory/864-197-0x0000000000000000-mapping.dmp

Download
memory/864-228-0x0000000000370000-0x000000000039A000-memory.dmp

Filesize
168KB

Download
memory/884-100-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/884-74-0x0000000000000000-mapping.dmp

Download
memory/900-318-0x0000000000000000-mapping.dmp

Download
memory/908-408-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/920-333-0x0000000000000000-mapping.dmp

Download
memory/948-141-0x0000000000000000-mapping.dmp

Download
memory/948-146-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/952-387-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/952-170-0x0000000000000000-mapping.dmp

Download
memory/952-180-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/952-307-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1080-334-0x0000000000000000-mapping.dmp

Download
memory/1104-302-0x0000000000000000-mapping.dmp

Download
memory/1116-186-0x0000000000000000-mapping.dmp

Download
memory/1116-189-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1120-173-0x0000000000000000-mapping.dmp

Download
memory/1144-203-0x0000000000000000-mapping.dmp

Download
memory/1168-95-0x0000000000000000-mapping.dmp

Download
memory/1168-104-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1168-102-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1288-235-0x0000000000000000-mapping.dmp

Download
memory/1288-295-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1288-267-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1308-338-0x0000000000000000-mapping.dmp

Download
memory/1328-213-0x0000000000000000-mapping.dmp

Download
memory/1328-218-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1328-251-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1336-222-0x0000000000280000-0x00000000002AA000-memory.dmp

Filesize
168KB

Download
memory/1336-98-0x0000000000280000-0x00000000002AA000-memory.dmp

Filesize
168KB

Download
memory/1336-91-0x0000000000280000-0x00000000002AA000-memory.dmp

Filesize
168KB

Download
memory/1364-281-0x0000000000000000-mapping.dmp

Download
memory/1364-347-0x00000000002D0000-0x00000000002FA000-memory.dmp

Filesize
168KB

Download
memory/1408-310-0x0000000000000000-mapping.dmp

Download
memory/1416-209-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1416-206-0x0000000000000000-mapping.dmp

Download
memory/1416-285-0x0000000000000000-mapping.dmp

Download
memory/1464-339-0x0000000000000000-mapping.dmp

Download
memory/1488-264-0x0000000000330000-0x000000000035A000-memory.dmp

Filesize
168KB

Download
memory/1488-230-0x0000000000000000-mapping.dmp

Download
memory/1488-261-0x0000000000330000-0x000000000035A000-memory.dmp

Filesize
168KB

Download
memory/1488-289-0x0000000000330000-0x000000000035A000-memory.dmp

Filesize
168KB

Download
memory/1488-287-0x0000000000330000-0x000000000035A000-memory.dmp

Filesize
168KB

Download
memory/1492-149-0x0000000000000000-mapping.dmp

Download
memory/1532-293-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1532-254-0x0000000000000000-mapping.dmp

Download
memory/1540-301-0x0000000000000000-mapping.dmp

Download
memory/1552-313-0x0000000000000000-mapping.dmp

Download
memory/1596-182-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1596-181-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1596-176-0x0000000000000000-mapping.dmp

Download
memory/1612-283-0x0000000000000000-mapping.dmp

Download
memory/1664-384-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1696-300-0x0000000000000000-mapping.dmp

Download
memory/1696-343-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1696-350-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1720-221-0x0000000000000000-mapping.dmp

Download
memory/1720-385-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1724-157-0x0000000000000000-mapping.dmp

Download
memory/1724-242-0x0000000000000000-mapping.dmp

Download
memory/1724-162-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1724-263-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1740-288-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1740-223-0x0000000000000000-mapping.dmp

Download
memory/1740-262-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1752-86-0x0000000000000000-mapping.dmp

Download
memory/1752-335-0x0000000000000000-mapping.dmp

Download
memory/1752-114-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1756-165-0x0000000000000000-mapping.dmp

Download
memory/1756-179-0x0000000000320000-0x000000000034A000-memory.dmp

Filesize
168KB

Download
memory/1764-257-0x0000000000000000-mapping.dmp

Download
memory/1764-337-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1764-294-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1784-331-0x0000000000000000-mapping.dmp

Download
memory/1816-322-0x0000000000000000-mapping.dmp

Download
memory/1836-328-0x00000000001D0000-0x00000000001FA000-memory.dmp

Filesize
168KB

Download
memory/1836-282-0x0000000000000000-mapping.dmp

Download
memory/1836-346-0x00000000001D0000-0x00000000001FA000-memory.dmp

Filesize
168KB

Download
memory/1868-229-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1868-227-0x0000000000000000-mapping.dmp

Download
memory/1868-398-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1868-280-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1928-256-0x0000000000000000-mapping.dmp

Download
memory/1928-296-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1940-217-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1940-388-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1940-200-0x0000000000000000-mapping.dmp

Download
memory/1976-210-0x0000000000000000-mapping.dmp

Download
memory/2016-107-0x0000000000000000-mapping.dmp

Download
memory/2020-117-0x0000000000000000-mapping.dmp

Download
memory/2020-130-0x00000000002D0000-0x00000000002FA000-memory.dmp

Filesize
168KB

Download
memory/2024-309-0x0000000000000000-mapping.dmp

Download