3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9

Analysis

max time kernel
176s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Size

127KB
MD5

a328717e0e518b200ae9f9ecd6ccb89a
SHA1

f52bd30443937265f7bc89edfe94d67f4d878637
SHA256

3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9
SHA512

d9bf03fc468e235a8724f7c07ab8af21f634a88a01c9668add84c6915811b869b4e71029ba7e0bda11ef52da4d2e55271c9e722fdbaeb45fd3a70d00a784e96a
SSDEEP

1536:enqdu3rbBGy3G8V0iuoKYMUYU6U5jUdPQc+n35KZg8/nouy8Iu:eqYMPsLMYjUtQl78vout

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

winlogon.exe smss.exe 3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe lsass.exe services.exe csrss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	csrss.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe csrss.exeizap.exelsass.exe services.exe csrss.exe winlogon.exe smss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe

Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

services.exe csrss.exe winlogon.exe smss.exe 3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe csrss.exeizap.exelsass.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	izap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

winlogon.exe smss.exe 3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe csrss.exeizap.exelsass.exe services.exe csrss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	izap.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe lsass.exe services.exe csrss.exe winlogon.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe lsass.exe services.exe csrss.exe winlogon.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 64 IoCs

Processes:

3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe csrss.execsrss.exe csrss.execsrss.exe izap.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe smss.exelsass.exesmss.exe lsass.exelsass.exe lsass.exelsass.exe lsass.exe services.execsrss.exeservices.exe csrss.exe services.execsrss.exesmss.exeParaysutki_VM_Communitysmss.exe csrss.exe winlogon.exelsass.exeping.exewinlogon.exe lsass.exe smss.exe csrss.exeConhost.exeservices.exe lsass.execsrss.exe lsass.exe ping.exewinlogon.exe smss.exeservices.exeservices.exeParaysutki_VM_Communityservices.exe services.exe smss.exe winlogon.exewinlogon.exelsass.exewinlogon.exe winlogon.exe lsass.exe Paraysutki_VM_CommunityParaysutki_VM_Communityservices.exeservices.exe winlogon.exewinlogon.exe winlogon.exe

pid	process
2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
800	csrss.exe
864	csrss.exe
1864	csrss.exe
2620	csrss.exe
2132	izap.exe
640	smss.exe
4920	smss.exe
1404	csrss.exe
4928	csrss.exe
1656	smss.exe
4824	smss.exe
4748	smss.exe
4208	lsass.exe
1968	smss.exe
908	lsass.exe
4064	lsass.exe
3136	lsass.exe
2700	lsass.exe
3416	lsass.exe
1996	services.exe
5016	csrss.exe
2652	services.exe
2492	csrss.exe
4720	services.exe
2292	csrss.exe
5104	smss.exe
3944	Paraysutki_VM_Community
4376	smss.exe
4756	csrss.exe
4128	winlogon.exe
3604	lsass.exe
1632	ping.exe
1032	winlogon.exe
2980	lsass.exe
3868	smss.exe
1252	csrss.exe
3376	Conhost.exe
4960	services.exe
3132	lsass.exe
5024	csrss.exe
3420	lsass.exe
5112	ping.exe
4124	winlogon.exe
1224	smss.exe
2804	services.exe
4540	services.exe
3456	Paraysutki_VM_Community
2464	services.exe
2012	services.exe
4872	smss.exe
856	winlogon.exe
4336	winlogon.exe
1620	lsass.exe
4304	winlogon.exe
4856	winlogon.exe
316	lsass.exe
724	Paraysutki_VM_Community
3872	Paraysutki_VM_Community
1668	services.exe
2112	services.exe
3296	winlogon.exe
996	winlogon.exe
2700	winlogon.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe lsass.exe services.exe smss.exe winlogon.exe csrss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	services.exe

Loads dropped DLL 64 IoCs

Processes:

csrss.execsrss.exe csrss.execsrss.exe smss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe smss.exelsass.exesmss.exe lsass.exelsass.exelsass.exe lsass.exe lsass.exe services.execsrss.exeservices.exe csrss.exe services.execsrss.exeParaysutki_VM_Communitysmss.exesmss.exe csrss.exe winlogon.exelsass.exeping.exewinlogon.exe lsass.exe smss.exe csrss.exeConhost.exeservices.exe lsass.execsrss.exe lsass.exe ping.exewinlogon.exe smss.exeservices.exeservices.exeParaysutki_VM_Communityservices.exe services.exe smss.exe winlogon.exewinlogon.exelsass.exewinlogon.exe winlogon.exe lsass.exe Paraysutki_VM_CommunityParaysutki_VM_Communityservices.exeservices.exe winlogon.exewinlogon.exe winlogon.exewinlogon.exe

pid	process
800	csrss.exe
864	csrss.exe
1864	csrss.exe
2620	csrss.exe
640	smss.exe
4920	smss.exe
1404	csrss.exe
4928	csrss.exe
1656	smss.exe
4824	smss.exe
4748	smss.exe
4208	lsass.exe
1968	smss.exe
908	lsass.exe
3136	lsass.exe
4064	lsass.exe
2700	lsass.exe
3416	lsass.exe
1996	services.exe
5016	csrss.exe
2652	services.exe
2492	csrss.exe
4720	services.exe
2292	csrss.exe
3944	Paraysutki_VM_Community
5104	smss.exe
4376	smss.exe
4756	csrss.exe
4128	winlogon.exe
3604	lsass.exe
1632	ping.exe
1032	winlogon.exe
2980	lsass.exe
3868	smss.exe
1252	csrss.exe
3376	Conhost.exe
4960	services.exe
3132	lsass.exe
5024	csrss.exe
3420	lsass.exe
5112	ping.exe
4124	winlogon.exe
1224	smss.exe
2804	services.exe
4540	services.exe
3456	Paraysutki_VM_Community
2464	services.exe
2012	services.exe
4872	smss.exe
856	winlogon.exe
4336	winlogon.exe
1620	lsass.exe
4856	winlogon.exe
4304	winlogon.exe
316	lsass.exe
724	Paraysutki_VM_Community
3872	Paraysutki_VM_Community
1668	services.exe
2112	services.exe
3296	winlogon.exe
996	winlogon.exe
2700	winlogon.exe
2116	winlogon.exe
3944	Paraysutki_VM_Community

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

lsass.exe services.exe csrss.exe smss.exe 3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe winlogon.exe izap.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

winlogon.exe smss.exe 3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe lsass.exe services.exe csrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

izap.exe

description	ioc	process
File opened (read-only)	\??\F:	izap.exe
File opened (read-only)	\??\K:	izap.exe
File opened (read-only)	\??\P:	izap.exe
File opened (read-only)	\??\S:	izap.exe
File opened (read-only)	\??\H:	izap.exe
File opened (read-only)	\??\L:	izap.exe
File opened (read-only)	\??\M:	izap.exe
File opened (read-only)	\??\T:	izap.exe
File opened (read-only)	\??\V:	izap.exe
File opened (read-only)	\??\W:	izap.exe
File opened (read-only)	\??\B:	izap.exe
File opened (read-only)	\??\I:	izap.exe
File opened (read-only)	\??\J:	izap.exe
File opened (read-only)	\??\O:	izap.exe
File opened (read-only)	\??\R:	izap.exe
File opened (read-only)	\??\X:	izap.exe
File opened (read-only)	\??\Y:	izap.exe
File opened (read-only)	\??\E:	izap.exe
File opened (read-only)	\??\G:	izap.exe
File opened (read-only)	\??\N:	izap.exe
File opened (read-only)	\??\Q:	izap.exe
File opened (read-only)	\??\U:	izap.exe
File opened (read-only)	\??\Z:	izap.exe

Drops file in System32 directory 64 IoCs

Processes:

csrss.exeservices.exe winlogon.exelsass.exe winlogon.exe 3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe csrss.exe smss.exeizap.exesmss.exe services.exesmss.exeParaysutki_VM_CommunityParaysutki_VM_Communitywinlogon.exeping.exeConhost.exeParaysutki_VM_Communitylsass.exeservices.exelsass.exesmss.execsrss.exe3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exeservices.exeservices.exelsass.exe

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	winlogon.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	izap.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	ping.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Conhost.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	services.exe
File created	\??\c:\windows\SysWOW64\maxtrox.txt	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	izap.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	smss.exe

Drops file in Program Files directory 27 IoCs

Processes:

izap.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	izap.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	izap.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	izap.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	izap.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	izap.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	izap.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	izap.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	izap.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	izap.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	izap.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	izap.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\setup_wm.exe	izap.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	izap.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	izap.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	izap.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	izap.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	izap.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	izap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

services.exe csrss.exe smss.exe 3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe lsass.exe winlogon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	lsass.exe

Modifies registry class 48 IoCs

Processes:

csrss.exeizap.exe3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe services.exe lsass.exe winlogon.exe csrss.exe smss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	izap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	izap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	izap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	izap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	izap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	izap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	izap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	izap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe

Runs ping.exe 1 TTPs 18 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
3424	ping.exe
4748	ping.exe
3184	ping.exe
1632	ping.exe
5112	ping.exe
2396	ping.exe
2084	ping.exe
4692	ping.exe
2072	ping.exe
1816	ping.exe
3716	ping.exe
5068	ping.exe
688	ping.exe
4616	ping.exe
4932	ping.exe
4604	ping.exe
4596	ping.exe
2696	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exesmss.exelsass.exe

pid	process
800	csrss.exe
800	csrss.exe
800	csrss.exe
800	csrss.exe
800	csrss.exe
800	csrss.exe
800	csrss.exe
800	csrss.exe
800	csrss.exe
800	csrss.exe
800	csrss.exe
800	csrss.exe
640	smss.exe
640	smss.exe
640	smss.exe
640	smss.exe
640	smss.exe
640	smss.exe
640	smss.exe
640	smss.exe
640	smss.exe
640	smss.exe
640	smss.exe
640	smss.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe
4208	lsass.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

2572 rundll32.exe
3972 rundll32.exe
1116 rundll32.exe
4956 rundll32.exe
2288 rundll32.exe
1712 rundll32.exe

pid	process
2572	rundll32.exe
3972	rundll32.exe
1116	rundll32.exe
4956	rundll32.exe
2288	rundll32.exe
1712	rundll32.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe csrss.execsrss.exe csrss.execsrss.exe izap.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exesmss.exesmss.exe lsass.exelsass.exe lsass.exelsass.exe lsass.exe services.execsrss.exeservices.exe csrss.exe services.exeParaysutki_VM_Communitycsrss.exesmss.exesmss.exe csrss.exe winlogon.exelsass.exeping.exewinlogon.exe lsass.exe smss.exe Conhost.execsrss.exeservices.exe lsass.execsrss.exe lsass.exe ping.exewinlogon.exe services.exeservices.exesmss.exeservices.exe services.exe smss.exe winlogon.exelsass.exewinlogon.exewinlogon.exe winlogon.exe lsass.exe services.exeParaysutki_VM_CommunityParaysutki_VM_Communityservices.exe winlogon.exewinlogon.exe winlogon.exe

pid	process
1812	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
800	csrss.exe
864	csrss.exe
1864	csrss.exe
2620	csrss.exe
2132	izap.exe
640	smss.exe
4920	smss.exe
1404	csrss.exe
4928	csrss.exe
1656	smss.exe
4824	smss.exe
4208	lsass.exe
4748	smss.exe
1968	smss.exe
908	lsass.exe
2700	lsass.exe
3136	lsass.exe
4064	lsass.exe
3416	lsass.exe
1996	services.exe
5016	csrss.exe
2652	services.exe
2492	csrss.exe
4720	services.exe
3944	Paraysutki_VM_Community
2292	csrss.exe
5104	smss.exe
4376	smss.exe
4756	csrss.exe
4128	winlogon.exe
3604	lsass.exe
1632	ping.exe
1032	winlogon.exe
2980	lsass.exe
3868	smss.exe
3376	Conhost.exe
1252	csrss.exe
4960	services.exe
3132	lsass.exe
5024	csrss.exe
3420	lsass.exe
5112	ping.exe
4124	winlogon.exe
2804	services.exe
4540	services.exe
1224	smss.exe
2464	services.exe
2012	services.exe
4872	smss.exe
856	winlogon.exe
1620	lsass.exe
4336	winlogon.exe
4304	winlogon.exe
4856	winlogon.exe
316	lsass.exe
1668	services.exe
3872	Paraysutki_VM_Community
724	Paraysutki_VM_Community
2112	services.exe
3296	winlogon.exe
996	winlogon.exe
2700	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 1812 wrote to memory of 2440	1812	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
PID 1812 wrote to memory of 2440	1812	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
PID 1812 wrote to memory of 2440	1812	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
PID 2440 wrote to memory of 800	2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	csrss.exe
PID 2440 wrote to memory of 800	2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	csrss.exe
PID 2440 wrote to memory of 800	2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	csrss.exe
PID 800 wrote to memory of 864	800	csrss.exe	csrss.exe
PID 800 wrote to memory of 864	800	csrss.exe	csrss.exe
PID 800 wrote to memory of 864	800	csrss.exe	csrss.exe
PID 864 wrote to memory of 1864	864	csrss.exe	csrss.exe
PID 864 wrote to memory of 1864	864	csrss.exe	csrss.exe
PID 864 wrote to memory of 1864	864	csrss.exe	csrss.exe
PID 1864 wrote to memory of 2620	1864	csrss.exe	csrss.exe
PID 1864 wrote to memory of 2620	1864	csrss.exe	csrss.exe
PID 1864 wrote to memory of 2620	1864	csrss.exe	csrss.exe
PID 1864 wrote to memory of 2132	1864	csrss.exe	izap.exe
PID 1864 wrote to memory of 2132	1864	csrss.exe	izap.exe
PID 1864 wrote to memory of 2132	1864	csrss.exe	izap.exe
PID 864 wrote to memory of 640	864	csrss.exe	smss.exe
PID 864 wrote to memory of 640	864	csrss.exe	smss.exe
PID 864 wrote to memory of 640	864	csrss.exe	smss.exe
PID 640 wrote to memory of 4920	640	smss.exe	smss.exe
PID 640 wrote to memory of 4920	640	smss.exe	smss.exe
PID 640 wrote to memory of 4920	640	smss.exe	smss.exe
PID 4920 wrote to memory of 1404	4920	smss.exe	csrss.exe
PID 4920 wrote to memory of 1404	4920	smss.exe	csrss.exe
PID 4920 wrote to memory of 1404	4920	smss.exe	csrss.exe
PID 1404 wrote to memory of 4928	1404	csrss.exe	csrss.exe
PID 1404 wrote to memory of 4928	1404	csrss.exe	csrss.exe
PID 1404 wrote to memory of 4928	1404	csrss.exe	csrss.exe
PID 4920 wrote to memory of 1656	4920	smss.exe	smss.exe
PID 4920 wrote to memory of 1656	4920	smss.exe	smss.exe
PID 4920 wrote to memory of 1656	4920	smss.exe	smss.exe
PID 1656 wrote to memory of 4824	1656	smss.exe	smss.exe
PID 1656 wrote to memory of 4824	1656	smss.exe	smss.exe
PID 1656 wrote to memory of 4824	1656	smss.exe	smss.exe
PID 2440 wrote to memory of 4748	2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	smss.exe
PID 2440 wrote to memory of 4748	2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	smss.exe
PID 2440 wrote to memory of 4748	2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	smss.exe
PID 864 wrote to memory of 4208	864	csrss.exe	lsass.exe
PID 864 wrote to memory of 4208	864	csrss.exe	lsass.exe
PID 864 wrote to memory of 4208	864	csrss.exe	lsass.exe
PID 4748 wrote to memory of 1968	4748	smss.exe	smss.exe
PID 4748 wrote to memory of 1968	4748	smss.exe	smss.exe
PID 4748 wrote to memory of 1968	4748	smss.exe	smss.exe
PID 4920 wrote to memory of 908	4920	smss.exe	lsass.exe
PID 4920 wrote to memory of 908	4920	smss.exe	lsass.exe
PID 4920 wrote to memory of 908	4920	smss.exe	lsass.exe
PID 4208 wrote to memory of 4064	4208	lsass.exe	lsass.exe
PID 4208 wrote to memory of 4064	4208	lsass.exe	lsass.exe
PID 4208 wrote to memory of 4064	4208	lsass.exe	lsass.exe
PID 2440 wrote to memory of 3136	2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	lsass.exe
PID 2440 wrote to memory of 3136	2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	lsass.exe
PID 2440 wrote to memory of 3136	2440	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe	lsass.exe
PID 908 wrote to memory of 2700	908	lsass.exe	lsass.exe
PID 908 wrote to memory of 2700	908	lsass.exe	lsass.exe
PID 908 wrote to memory of 2700	908	lsass.exe	lsass.exe
PID 3136 wrote to memory of 3416	3136	lsass.exe	lsass.exe
PID 3136 wrote to memory of 3416	3136	lsass.exe	lsass.exe
PID 3136 wrote to memory of 3416	3136	lsass.exe	lsass.exe
PID 4920 wrote to memory of 1996	4920	smss.exe	services.exe
PID 4920 wrote to memory of 1996	4920	smss.exe	services.exe
PID 4920 wrote to memory of 1996	4920	smss.exe	services.exe
PID 4064 wrote to memory of 5016	4064	lsass.exe	csrss.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

lsass.exe csrss.exe winlogon.exe 3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe smss.exe services.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe

C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
"C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812

C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2440

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:864

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2620

\??\c:\Documents and Settings\Admin\Application Data\Microsoft\izap.exe
"c:\Documents and Settings\Admin\Application Data\Microsoft\izap.exe" csrss
6⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2132

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4920

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4928

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4824

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2700

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1996

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
8⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2652

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2292

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4756

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
9⤵
PID:1632

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3868

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3132

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3420

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2804

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2464

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:856

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4304

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
9⤵
- Suspicious use of FindShellTrayWindow
PID:1116

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:4604

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:4596

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:1816

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2700

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
8⤵
- Loads dropped DLL
PID:2116

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
7⤵
- Drops file in System32 directory
PID:4248

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
7⤵
- Suspicious use of FindShellTrayWindow
PID:2288

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:2084

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Runs ping.exe
- Suspicious use of SetWindowsHookEx
PID:5112

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:4692

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4064

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5016

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:5104

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4376

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3604

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2980

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
7⤵
PID:3376

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4960

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
7⤵
PID:5112

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4124

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
7⤵
- Suspicious use of FindShellTrayWindow
PID:2572

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:2072

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:4616

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:4932

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4540

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2012

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4336

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
- Suspicious use of FindShellTrayWindow
PID:3972

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:3424

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:2396

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:4748

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4720

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
4⤵
PID:3944

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4128

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1032

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1252

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5024

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1224

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4872

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:316

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3296

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:996

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
- Suspicious use of FindShellTrayWindow
PID:4956

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:2696

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:3184

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Runs ping.exe
- Suspicious use of SetWindowsHookEx
PID:1632

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
3⤵
PID:4672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
3⤵
- Suspicious use of FindShellTrayWindow
PID:1712

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:3716

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:5068

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:688

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3416

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\izap.exe
Filesize
76KB

MD5
fc70414ebd923673481d2b5e9cda6146

SHA1
c012f1dff9c5b803f06782ec72f48af83ebfb931

SHA256
3caf842114d5713b925033c6401c45b99c57efa390e28d748e4abed9e20d0512

SHA512
012cbc84e7bc1fb1075d0d2b70b4258ee12583557a63560abcf623083a90b88c604dd7ad06981cd14adf2bd720763a0bf886055feb2f1f063b0fd4c3f025a36b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLL
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
Filesize
50KB

MD5
940d24de51296709ead002014ae37c40

SHA1
7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

SHA256
d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

SHA512
6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
Filesize
127KB

MD5
b27872fbd73dbd1593b462d382142c38

SHA1
1781055ba33ce2057cb43fd053fc869730ece308

SHA256
91c5350c7064f4001a58304d1928b5bd8960256bded58a17f22b4113fa544ba5

SHA512
00a95bab0056acf59463340c5a8214ebb916f4fefae5158d6bf6ebda8b6fe9d2db3f6822f7cf64cb19e8a6089410e072595a6888db3934b9f1b257c979454840

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\izap.exe
Filesize
76KB

MD5
fc70414ebd923673481d2b5e9cda6146

SHA1
c012f1dff9c5b803f06782ec72f48af83ebfb931

SHA256
3caf842114d5713b925033c6401c45b99c57efa390e28d748e4abed9e20d0512

SHA512
012cbc84e7bc1fb1075d0d2b70b4258ee12583557a63560abcf623083a90b88c604dd7ad06981cd14adf2bd720763a0bf886055feb2f1f063b0fd4c3f025a36b

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr
Filesize
76KB

MD5
865c5982e444dec511089953e3044457

SHA1
9b44bf6569a5e4537e56dcf0fabc766ac98479d9

SHA256
61d32eef30716d0beda884945bde9a4069fa7164450a147d69209f67a51b640b

SHA512
5794d9ba0a39e15f82c8d415691b4a60be0df74f5e31061bdb9fee205cc07a8e918eb060d49670d39798e52470d34f95cc428c00cb32d3d48418626290e59294

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt
Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
memory/316-391-0x0000000000000000-mapping.dmp

Download
memory/316-401-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/640-179-0x0000000000000000-mapping.dmp

Download
memory/724-400-0x0000000000000000-mapping.dmp

Download
memory/800-139-0x0000000000000000-mapping.dmp

Download
memory/856-377-0x0000000000000000-mapping.dmp

Download
memory/864-178-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/864-420-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/864-148-0x0000000000000000-mapping.dmp

Download
memory/908-236-0x0000000000000000-mapping.dmp

Download
memory/996-424-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/996-427-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1032-314-0x0000000000000000-mapping.dmp

Download
memory/1032-434-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1032-355-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1224-351-0x0000000000000000-mapping.dmp

Download
memory/1252-324-0x0000000000000000-mapping.dmp

Download
memory/1404-192-0x0000000000000000-mapping.dmp

Download
memory/1620-382-0x0000000000000000-mapping.dmp

Download
memory/1632-309-0x0000000000000000-mapping.dmp

Download
memory/1656-204-0x0000000000000000-mapping.dmp

Download
memory/1668-404-0x0000000000000000-mapping.dmp

Download
memory/1864-159-0x0000000000000000-mapping.dmp

Download
memory/1968-256-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1968-232-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1968-229-0x0000000000000000-mapping.dmp

Download
memory/1996-262-0x0000000000000000-mapping.dmp

Download
memory/2012-368-0x0000000000000000-mapping.dmp

Download
memory/2012-379-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2072-410-0x0000000000000000-mapping.dmp

Download
memory/2112-417-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2132-171-0x0000000000000000-mapping.dmp

Download
memory/2292-288-0x0000000000000000-mapping.dmp

Download
memory/2440-147-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2440-134-0x0000000000000000-mapping.dmp

Download
memory/2440-438-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2464-374-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2464-363-0x0000000000000000-mapping.dmp

Download
memory/2492-278-0x0000000000000000-mapping.dmp

Download
memory/2492-291-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2572-373-0x0000000000000000-mapping.dmp

Download
memory/2620-170-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2620-165-0x0000000000000000-mapping.dmp

Download
memory/2652-311-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-277-0x0000000000000000-mapping.dmp

Download
memory/2652-426-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2700-267-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2700-245-0x0000000000000000-mapping.dmp

Download
memory/2804-352-0x0000000000000000-mapping.dmp

Download
memory/2980-317-0x0000000000000000-mapping.dmp

Download
memory/2980-326-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3132-335-0x0000000000000000-mapping.dmp

Download
memory/3136-244-0x0000000000000000-mapping.dmp

Download
memory/3376-328-0x0000000000000000-mapping.dmp

Download
memory/3416-261-0x0000000000000000-mapping.dmp

Download
memory/3416-275-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3416-280-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3420-354-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3420-341-0x0000000000000000-mapping.dmp

Download
memory/3456-365-0x0000000000000000-mapping.dmp

Download
memory/3604-307-0x0000000000000000-mapping.dmp

Download
memory/3868-333-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-320-0x0000000000000000-mapping.dmp

Download
memory/3872-403-0x0000000000000000-mapping.dmp

Download
memory/3944-289-0x0000000000000000-mapping.dmp

Download
memory/3944-300-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4064-279-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4064-416-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4064-243-0x0000000000000000-mapping.dmp

Download
memory/4124-350-0x0000000000000000-mapping.dmp

Download
memory/4124-358-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4124-366-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4128-303-0x0000000000000000-mapping.dmp

Download
memory/4208-220-0x0000000000000000-mapping.dmp

Download
memory/4304-390-0x0000000000000000-mapping.dmp

Download
memory/4304-402-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4304-398-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4336-380-0x0000000000000000-mapping.dmp

Download
memory/4376-298-0x0000000000000000-mapping.dmp

Download
memory/4376-310-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4540-359-0x0000000000000000-mapping.dmp

Download
memory/4616-406-0x0000000000000000-mapping.dmp

Download
memory/4720-283-0x0000000000000000-mapping.dmp

Download
memory/4748-217-0x0000000000000000-mapping.dmp

Download
memory/4756-308-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4756-299-0x0000000000000000-mapping.dmp

Download
memory/4824-216-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4824-211-0x0000000000000000-mapping.dmp

Download
memory/4824-238-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4856-389-0x0000000000000000-mapping.dmp

Download
memory/4856-399-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4872-385-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4872-370-0x0000000000000000-mapping.dmp

Download
memory/4920-219-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4920-185-0x0000000000000000-mapping.dmp

Download
memory/4920-191-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4920-437-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4928-203-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4928-198-0x0000000000000000-mapping.dmp

Download
memory/4928-206-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4932-405-0x0000000000000000-mapping.dmp

Download
memory/4960-343-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4960-332-0x0000000000000000-mapping.dmp

Download
memory/5016-265-0x0000000000000000-mapping.dmp

Download
memory/5024-337-0x0000000000000000-mapping.dmp

Download
memory/5104-290-0x0000000000000000-mapping.dmp

Download
memory/5112-344-0x0000000000000000-mapping.dmp

Download