4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a

Analysis

max time kernel
227s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Size

205KB
MD5

8f2c91d52951d6da1be44ac1ee38cbd3
SHA1

0d374f2cb7e25566c489eec0a3244ee05562bc68
SHA256

4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a
SHA512

c0770d0b8761fbfbdfd49acbffa979ba605be6795f70e9a533e7984824a3964622f27f0c2303480126994e75e15abbd196c6f3b7fac23fa5add204fc63aae615
SSDEEP

3072:eqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:eqhMPssRARoiSoS3SsQLH5AK

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

csrss.exe smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

csrss.exedsag.execsrss.exe smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	dsag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe csrss.exedsag.execsrss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	dsag.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

csrss.exedsag.execsrss.exe smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dsag.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

csrss.exe smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Disables RegEdit via registry modification 3 IoCs

evasion

Processes:

4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe csrss.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 40 IoCs

Processes:

4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe csrss.execsrss.exe csrss.execsrss.exe dsag.exesmss.exesmss.exe csrss.execsrss.exe smss.exelsass.exesmss.exesmss.exe smss.exe services.exelsass.exelsass.exelsass.exe lsass.exe lsass.exe services.exe winlogon.exeservices.exeservices.exe~Paraysutki_VM_Community~winlogon.exewinlogon.exeservices.exe ~Paraysutki_VM_Community~~Paraysutki_VM_Community~winlogon.exe winlogon.exe csrss.execsrss.exe smss.execsrss.exelsass.exesmss.exeservices.exe

pid	process
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
680	csrss.exe
2016	csrss.exe
1580	csrss.exe
1692	csrss.exe
1436	dsag.exe
1956	smss.exe
524	smss.exe
1252	csrss.exe
692	csrss.exe
1260	smss.exe
1164	lsass.exe
964	smss.exe
1508	smss.exe
588	smss.exe
840	services.exe
1908	lsass.exe
396	lsass.exe
1108	lsass.exe
808	lsass.exe
1844	lsass.exe
316	services.exe
1328	winlogon.exe
1580	services.exe
1912	services.exe
1568	~Paraysutki_VM_Community~
2020	winlogon.exe
1416	winlogon.exe
1176	services.exe
1332	~Paraysutki_VM_Community~
1372	~Paraysutki_VM_Community~
1904	winlogon.exe
1636	winlogon.exe
580	csrss.exe
712	csrss.exe
536	smss.exe
1676	csrss.exe
636	lsass.exe
1992	smss.exe
272	services.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe csrss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe\Debugger = "cmd.exe /c del"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe\Debugger = "cmd.exe /c del"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Loads dropped DLL 64 IoCs

Processes:

pid	process
960	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
960	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
680	csrss.exe
680	csrss.exe
680	csrss.exe
2016	csrss.exe
2016	csrss.exe
2016	csrss.exe
1580	csrss.exe
1580	csrss.exe
1692	csrss.exe
1580	csrss.exe
1580	csrss.exe
2016	csrss.exe
2016	csrss.exe
1956	smss.exe
1956	smss.exe
1956	smss.exe
524	smss.exe
524	smss.exe
524	smss.exe
1252	csrss.exe
1252	csrss.exe
692	csrss.exe
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
2016	csrss.exe
524	smss.exe
2016	csrss.exe
524	smss.exe
1260	smss.exe
1164	lsass.exe
964	smss.exe
2016	csrss.exe
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
524	smss.exe
1260	smss.exe
964	smss.exe
2016	csrss.exe
1508	smss.exe
588	smss.exe
840	services.exe
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
524	smss.exe
1908	lsass.exe
396	lsass.exe
1164	lsass.exe
396	lsass.exe
396	lsass.exe
1908	lsass.exe
1164	lsass.exe
840	services.exe
1108	lsass.exe
840	services.exe
808	lsass.exe
1844	lsass.exe
316	services.exe
2016	csrss.exe
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
524	smss.exe
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
524	smss.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dsag.execsrss.exe smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	dsag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	dsag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

csrss.exe smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dsag.exe

description	ioc	process
File opened (read-only)	\??\S:	dsag.exe
File opened (read-only)	\??\V:	dsag.exe
File opened (read-only)	\??\G:	dsag.exe
File opened (read-only)	\??\J:	dsag.exe
File opened (read-only)	\??\L:	dsag.exe
File opened (read-only)	\??\X:	dsag.exe
File opened (read-only)	\??\Y:	dsag.exe
File opened (read-only)	\??\H:	dsag.exe
File opened (read-only)	\??\M:	dsag.exe
File opened (read-only)	\??\R:	dsag.exe
File opened (read-only)	\??\Q:	dsag.exe
File opened (read-only)	\??\U:	dsag.exe
File opened (read-only)	\??\W:	dsag.exe
File opened (read-only)	\??\Z:	dsag.exe
File opened (read-only)	\??\E:	dsag.exe
File opened (read-only)	\??\F:	dsag.exe
File opened (read-only)	\??\K:	dsag.exe
File opened (read-only)	\??\O:	dsag.exe
File opened (read-only)	\??\P:	dsag.exe
File opened (read-only)	\??\T:	dsag.exe
File opened (read-only)	\??\B:	dsag.exe
File opened (read-only)	\??\I:	dsag.exe
File opened (read-only)	\??\N:	dsag.exe

Drops file in System32 directory 64 IoCs

Processes:

csrss.execsrss.exe services.exe dsag.exesmss.exe winlogon.exewinlogon.exe4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe smss.exelsass.exe lsass.exesmss.exelsass.exeservices.exe~Paraysutki_VM_Community~csrss.exe~Paraysutki_VM_Community~smss.exe~Paraysutki_VM_Community~

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	dsag.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	dsag.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	dsag.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	dsag.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	lsass.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Drops file in Program Files directory 34 IoCs

Processes:

dsag.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	dsag.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	dsag.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	dsag.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	dsag.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	dsag.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe csrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	smss.exe

Modifies registry class 42 IoCs

Processes:

csrss.execsrss.exe dsag.exe4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe smss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	dsag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	dsag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	dsag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	dsag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	dsag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	dsag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	dsag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	dsag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	dsag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	dsag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	dsag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	dsag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	dsag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	dsag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	dsag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	dsag.exe

Runs ping.exe 1 TTPs 9 IoCs

Remote System Discovery
T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid process

280 ping.exe
836 ping.exe
808 ping.exe
1700 ping.exe
1120 ping.exe
760 ping.exe
396 ping.exe
336 ping.exe
1360 ping.exe

pid	process
280	ping.exe
836	ping.exe
808	ping.exe
1700	ping.exe
1120	ping.exe
760	ping.exe
396	ping.exe
336	ping.exe
1360	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exesmss.exeservices.exelsass.exe

pid	process
680	csrss.exe
680	csrss.exe
680	csrss.exe
680	csrss.exe
680	csrss.exe
680	csrss.exe
680	csrss.exe
680	csrss.exe
680	csrss.exe
680	csrss.exe
1956	smss.exe
1956	smss.exe
1956	smss.exe
1956	smss.exe
1956	smss.exe
1956	smss.exe
1956	smss.exe
1956	smss.exe
1956	smss.exe
1956	smss.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
840	services.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe
1164	lsass.exe

Suspicious use of SetWindowsHookEx 38 IoCs

Processes:

4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe csrss.execsrss.exe csrss.execsrss.exe dsag.exesmss.exesmss.exe csrss.execsrss.exe lsass.exesmss.exesmss.exeservices.exelsass.exesmss.exe lsass.exesmss.exe lsass.exe services.exe lsass.exe lsass.exe services.exe~Paraysutki_VM_Community~winlogon.exewinlogon.exe~Paraysutki_VM_Community~services.exe ~Paraysutki_VM_Community~winlogon.exe winlogon.exe csrss.exesmss.execsrss.exe services.exelsass.execsrss.exe

pid	process
960	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
680	csrss.exe
2016	csrss.exe
1580	csrss.exe
1692	csrss.exe
1436	dsag.exe
1956	smss.exe
524	smss.exe
1252	csrss.exe
692	csrss.exe
1164	lsass.exe
1260	smss.exe
964	smss.exe
840	services.exe
396	lsass.exe
588	smss.exe
1908	lsass.exe
1508	smss.exe
1108	lsass.exe
316	services.exe
1844	lsass.exe
808	lsass.exe
1580	services.exe
1568	~Paraysutki_VM_Community~
1416	winlogon.exe
2020	winlogon.exe
1332	~Paraysutki_VM_Community~
1176	services.exe
1372	~Paraysutki_VM_Community~
1636	winlogon.exe
1904	winlogon.exe
580	csrss.exe
536	smss.exe
712	csrss.exe
1912	services.exe
636	lsass.exe
1676	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 960 wrote to memory of 596	960	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
PID 960 wrote to memory of 596	960	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
PID 960 wrote to memory of 596	960	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
PID 960 wrote to memory of 596	960	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
PID 596 wrote to memory of 680	596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	csrss.exe
PID 596 wrote to memory of 680	596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	csrss.exe
PID 596 wrote to memory of 680	596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	csrss.exe
PID 596 wrote to memory of 680	596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	csrss.exe
PID 680 wrote to memory of 2016	680	csrss.exe	csrss.exe
PID 680 wrote to memory of 2016	680	csrss.exe	csrss.exe
PID 680 wrote to memory of 2016	680	csrss.exe	csrss.exe
PID 680 wrote to memory of 2016	680	csrss.exe	csrss.exe
PID 2016 wrote to memory of 1580	2016	csrss.exe	csrss.exe
PID 2016 wrote to memory of 1580	2016	csrss.exe	csrss.exe
PID 2016 wrote to memory of 1580	2016	csrss.exe	csrss.exe
PID 2016 wrote to memory of 1580	2016	csrss.exe	csrss.exe
PID 1580 wrote to memory of 1692	1580	csrss.exe	csrss.exe
PID 1580 wrote to memory of 1692	1580	csrss.exe	csrss.exe
PID 1580 wrote to memory of 1692	1580	csrss.exe	csrss.exe
PID 1580 wrote to memory of 1692	1580	csrss.exe	csrss.exe
PID 1580 wrote to memory of 1436	1580	csrss.exe	dsag.exe
PID 1580 wrote to memory of 1436	1580	csrss.exe	dsag.exe
PID 1580 wrote to memory of 1436	1580	csrss.exe	dsag.exe
PID 1580 wrote to memory of 1436	1580	csrss.exe	dsag.exe
PID 2016 wrote to memory of 1956	2016	csrss.exe	smss.exe
PID 2016 wrote to memory of 1956	2016	csrss.exe	smss.exe
PID 2016 wrote to memory of 1956	2016	csrss.exe	smss.exe
PID 2016 wrote to memory of 1956	2016	csrss.exe	smss.exe
PID 1956 wrote to memory of 524	1956	smss.exe	smss.exe
PID 1956 wrote to memory of 524	1956	smss.exe	smss.exe
PID 1956 wrote to memory of 524	1956	smss.exe	smss.exe
PID 1956 wrote to memory of 524	1956	smss.exe	smss.exe
PID 524 wrote to memory of 1252	524	smss.exe	csrss.exe
PID 524 wrote to memory of 1252	524	smss.exe	csrss.exe
PID 524 wrote to memory of 1252	524	smss.exe	csrss.exe
PID 524 wrote to memory of 1252	524	smss.exe	csrss.exe
PID 1252 wrote to memory of 692	1252	csrss.exe	csrss.exe
PID 1252 wrote to memory of 692	1252	csrss.exe	csrss.exe
PID 1252 wrote to memory of 692	1252	csrss.exe	csrss.exe
PID 1252 wrote to memory of 692	1252	csrss.exe	csrss.exe
PID 596 wrote to memory of 1260	596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	smss.exe
PID 596 wrote to memory of 1260	596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	smss.exe
PID 596 wrote to memory of 1260	596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	smss.exe
PID 596 wrote to memory of 1260	596	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe	smss.exe
PID 2016 wrote to memory of 1164	2016	csrss.exe	lsass.exe
PID 2016 wrote to memory of 1164	2016	csrss.exe	lsass.exe
PID 2016 wrote to memory of 1164	2016	csrss.exe	lsass.exe
PID 2016 wrote to memory of 1164	2016	csrss.exe	lsass.exe
PID 524 wrote to memory of 964	524	smss.exe	smss.exe
PID 524 wrote to memory of 964	524	smss.exe	smss.exe
PID 524 wrote to memory of 964	524	smss.exe	smss.exe
PID 524 wrote to memory of 964	524	smss.exe	smss.exe
PID 1260 wrote to memory of 1508	1260	smss.exe	smss.exe
PID 1260 wrote to memory of 1508	1260	smss.exe	smss.exe
PID 1260 wrote to memory of 1508	1260	smss.exe	smss.exe
PID 1260 wrote to memory of 1508	1260	smss.exe	smss.exe
PID 964 wrote to memory of 588	964	smss.exe	smss.exe
PID 964 wrote to memory of 588	964	smss.exe	smss.exe
PID 964 wrote to memory of 588	964	smss.exe	smss.exe
PID 964 wrote to memory of 588	964	smss.exe	smss.exe
PID 2016 wrote to memory of 840	2016	csrss.exe	services.exe
PID 2016 wrote to memory of 840	2016	csrss.exe	services.exe
PID 2016 wrote to memory of 840	2016	csrss.exe	services.exe
PID 2016 wrote to memory of 840	2016	csrss.exe	services.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

csrss.exe smss.exe 4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

C:\Users\Admin\AppData\Local\Temp\4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
"C:\Users\Admin\AppData\Local\Temp\4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
C:\Users\Admin\AppData\Local\Temp\4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:596

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2016

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1692

\??\c:\Documents and Settings\Admin\Application Data\Microsoft\dsag.exe
"c:\Documents and Settings\Admin\Application Data\Microsoft\dsag.exe" csrss
6⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1436

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:524

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:692

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:588

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:396

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:808

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1912

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
8⤵
PID:568

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1416

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1636

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
9⤵
PID:1904

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1332

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
7⤵
PID:960

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:836

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:808

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
7⤵
- Runs ping.exe
PID:1360

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
7⤵
PID:824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
7⤵
PID:1112

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1164

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1844

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:840

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:316

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1676

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
8⤵
PID:1692

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
7⤵
- Executes dropped EXE
PID:1992

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
8⤵
PID:1976

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
7⤵
PID:1776

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
8⤵
PID:1840

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
5⤵
- Executes dropped EXE
PID:1328

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
PID:1544

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:1700

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:760

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
5⤵
- Runs ping.exe
PID:396

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
5⤵
PID:2020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
5⤵
PID:1092

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1508

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1108

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:580

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:712

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:536

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
6⤵
PID:1348

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:636

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
6⤵
PID:1040

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
5⤵
- Executes dropped EXE
PID:272

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1580

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1176

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2020

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1904

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
3⤵
PID:1704

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:280

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:1120

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
3⤵
- Runs ping.exe
PID:336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
3⤵
PID:580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
3⤵
PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\dsag.exe

Filesize
76KB

MD5
7a455f4a433fc9a8d7479153c5ca227e

SHA1
820a5b86ee09ccd8b95918510f84710cea8a6c54

SHA256
d6afd771a2ee48177b59a202a421ebbb1f365b83998cb58985cf8b6cd194797d

SHA512
c237d948b28cec158aa84ecbe0b8d827d8318bb854d36dee04fe3ab59fdd3480fbd83619b7135e5413e44bdd53d5dc3349dfbfa517bfd53fca1de2ee0895ebc5

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\dsag.exe

Filesize
76KB

MD5
7a455f4a433fc9a8d7479153c5ca227e

SHA1
820a5b86ee09ccd8b95918510f84710cea8a6c54

SHA256
d6afd771a2ee48177b59a202a421ebbb1f365b83998cb58985cf8b6cd194797d

SHA512
c237d948b28cec158aa84ecbe0b8d827d8318bb854d36dee04fe3ab59fdd3480fbd83619b7135e5413e44bdd53d5dc3349dfbfa517bfd53fca1de2ee0895ebc5

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
071870fc5adff1d654833d5af8651344

SHA1
6816f89a2a4fca46f1f2d48690f0cade904ecb80

SHA256
598976f18c47900039aac79e3f6fbe5d484c3a054207d4d1a28d843ba8b11db4

SHA512
2bfedea2b089b6b0ba5d12d42ab5f08dcbc22dc5aeabaa198fbc062517d0c489b790f17bf5d6d168bf124924f8365268bba7f6aa6089a711fae2fdaf137d9734

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Users\Admin\AppData\Local\Temp\4687fe71e7d3b3866a5ffdc9622daff21bb0d565d2d0918345998d37bb98671a.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\dsag.exe

Filesize
76KB

MD5
7a455f4a433fc9a8d7479153c5ca227e

SHA1
820a5b86ee09ccd8b95918510f84710cea8a6c54

SHA256
d6afd771a2ee48177b59a202a421ebbb1f365b83998cb58985cf8b6cd194797d

SHA512
c237d948b28cec158aa84ecbe0b8d827d8318bb854d36dee04fe3ab59fdd3480fbd83619b7135e5413e44bdd53d5dc3349dfbfa517bfd53fca1de2ee0895ebc5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\dsag.exe

Filesize
76KB

MD5
7a455f4a433fc9a8d7479153c5ca227e

SHA1
820a5b86ee09ccd8b95918510f84710cea8a6c54

SHA256
d6afd771a2ee48177b59a202a421ebbb1f365b83998cb58985cf8b6cd194797d

SHA512
c237d948b28cec158aa84ecbe0b8d827d8318bb854d36dee04fe3ab59fdd3480fbd83619b7135e5413e44bdd53d5dc3349dfbfa517bfd53fca1de2ee0895ebc5

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
29eee5a464ba4f15da4c65db771bb6d2

SHA1
5bd537961321b35291a314baddf03381098dd4c1

SHA256
42aee081b53f988364c716b2681bbe4dc0743f40c46968304f8e4e03b2371c84

SHA512
c291af20bc9eb635600c4370f7040e0b674d067372287bc664838410e4857b00a588c8db6bbf1aeb6a2d7928ba8c5ac703d8d6800016d254bfd2b9d73643d7e4

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
memory/272-291-0x0000000000000000-mapping.dmp

Download
memory/280-290-0x0000000000000000-mapping.dmp

Download
memory/316-198-0x0000000000000000-mapping.dmp

Download
memory/316-212-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/336-306-0x0000000000000000-mapping.dmp

Download
memory/396-208-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/396-219-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/396-220-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/396-180-0x0000000000000000-mapping.dmp

Download
memory/396-307-0x0000000000000000-mapping.dmp

Download
memory/524-147-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/524-126-0x0000000000000000-mapping.dmp

Download
memory/536-272-0x0000000000000000-mapping.dmp

Download
memory/536-304-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/568-295-0x0000000000000000-mapping.dmp

Download
memory/580-245-0x0000000000000000-mapping.dmp

Download
memory/580-313-0x0000000000000000-mapping.dmp

Download
memory/588-281-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/588-177-0x0000000000000000-mapping.dmp

Download
memory/588-194-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/596-58-0x0000000000000000-mapping.dmp

Download
memory/596-70-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/636-278-0x0000000000000000-mapping.dmp

Download
memory/680-64-0x0000000000000000-mapping.dmp

Download
memory/680-99-0x0000000000310000-0x000000000033A000-memory.dmp

Filesize
168KB

Download
memory/680-158-0x0000000000310000-0x000000000033A000-memory.dmp

Filesize
168KB

Download
memory/680-157-0x0000000000310000-0x000000000033A000-memory.dmp

Filesize
168KB

Download
memory/680-97-0x0000000000310000-0x000000000033A000-memory.dmp

Filesize
168KB

Download
memory/692-145-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/692-140-0x0000000000000000-mapping.dmp

Download
memory/712-256-0x0000000000000000-mapping.dmp

Download
memory/712-261-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/760-302-0x0000000000000000-mapping.dmp

Download
memory/808-263-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/808-308-0x0000000000000000-mapping.dmp

Download
memory/808-195-0x0000000000000000-mapping.dmp

Download
memory/808-210-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/824-318-0x0000000000000000-mapping.dmp

Download
memory/836-296-0x0000000000000000-mapping.dmp

Download
memory/840-178-0x0000000000000000-mapping.dmp

Download
memory/960-68-0x00000000002D0000-0x00000000002FA000-memory.dmp

Filesize
168KB

Download
memory/960-266-0x0000000000000000-mapping.dmp

Download
memory/960-155-0x00000000002D0000-0x00000000002FA000-memory.dmp

Filesize
168KB

Download
memory/960-69-0x00000000002D0000-0x00000000002FA000-memory.dmp

Filesize
168KB

Download
memory/960-156-0x00000000002D0000-0x00000000002FA000-memory.dmp

Filesize
168KB

Download
memory/964-192-0x0000000000420000-0x000000000044A000-memory.dmp

Filesize
168KB

Download
memory/964-162-0x0000000000000000-mapping.dmp

Download
memory/964-217-0x0000000000420000-0x000000000044A000-memory.dmp

Filesize
168KB

Download
memory/1040-294-0x0000000000000000-mapping.dmp

Download
memory/1108-209-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1108-196-0x0000000000000000-mapping.dmp

Download
memory/1112-321-0x0000000000000000-mapping.dmp

Download
memory/1120-301-0x0000000000000000-mapping.dmp

Download
memory/1164-160-0x0000000000000000-mapping.dmp

Download
memory/1164-207-0x0000000000360000-0x000000000038A000-memory.dmp

Filesize
168KB

Download
memory/1164-218-0x0000000000360000-0x000000000038A000-memory.dmp

Filesize
168KB

Download
memory/1176-228-0x0000000000000000-mapping.dmp

Download
memory/1176-333-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1176-260-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1176-236-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1252-133-0x0000000000000000-mapping.dmp

Download
memory/1252-148-0x0000000000280000-0x00000000002AA000-memory.dmp

Filesize
168KB

Download
memory/1260-151-0x0000000000000000-mapping.dmp

Download
memory/1260-191-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download
memory/1260-216-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download
memory/1328-215-0x0000000000000000-mapping.dmp

Download
memory/1332-237-0x0000000000000000-mapping.dmp

Download
memory/1348-293-0x0000000000000000-mapping.dmp

Download
memory/1360-311-0x0000000000000000-mapping.dmp

Download
memory/1372-238-0x0000000000000000-mapping.dmp

Download
memory/1416-250-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1416-273-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1416-222-0x0000000000000000-mapping.dmp

Download
memory/1416-275-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1436-108-0x0000000000000000-mapping.dmp

Download
memory/1488-327-0x0000000000000000-mapping.dmp

Download
memory/1508-176-0x0000000000000000-mapping.dmp

Download
memory/1508-193-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1508-239-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1544-265-0x0000000000000000-mapping.dmp

Download
memory/1568-221-0x0000000000000000-mapping.dmp

Download
memory/1580-213-0x0000000000000000-mapping.dmp

Download
memory/1580-89-0x0000000000000000-mapping.dmp

Download
memory/1580-116-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1580-235-0x0000000000240000-0x000000000026A000-memory.dmp

Filesize
168KB

Download
memory/1580-259-0x0000000000240000-0x000000000026A000-memory.dmp

Filesize
168KB

Download
memory/1636-244-0x0000000000000000-mapping.dmp

Download
memory/1636-276-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1676-315-0x0000000000290000-0x00000000002BA000-memory.dmp

Filesize
168KB

Download
memory/1676-277-0x0000000000000000-mapping.dmp

Download
memory/1692-105-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1692-98-0x0000000000000000-mapping.dmp

Download
memory/1692-309-0x0000000000000000-mapping.dmp

Download
memory/1700-292-0x0000000000000000-mapping.dmp

Download
memory/1704-270-0x0000000000000000-mapping.dmp

Download
memory/1776-298-0x0000000000000000-mapping.dmp

Download
memory/1844-197-0x0000000000000000-mapping.dmp

Download
memory/1844-211-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1904-243-0x0000000000000000-mapping.dmp

Download
memory/1904-262-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1904-305-0x0000000000000000-mapping.dmp

Download
memory/1904-251-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1908-179-0x0000000000000000-mapping.dmp

Download
memory/1912-214-0x0000000000000000-mapping.dmp

Download
memory/1956-175-0x00000000003C0000-0x00000000003EA000-memory.dmp

Filesize
168KB

Download
memory/1956-146-0x00000000003C0000-0x00000000003EA000-memory.dmp

Filesize
168KB

Download
memory/1956-118-0x0000000000000000-mapping.dmp

Download
memory/1976-323-0x0000000000000000-mapping.dmp

Download
memory/1992-280-0x0000000000000000-mapping.dmp

Download
memory/1992-325-0x0000000000390000-0x00000000003BA000-memory.dmp

Filesize
168KB

Download
memory/2016-101-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2016-258-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/2016-77-0x0000000000000000-mapping.dmp

Download
memory/2020-223-0x0000000000000000-mapping.dmp

Download
memory/2020-312-0x0000000000000000-mapping.dmp

Download