18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a

Analysis

max time kernel
41s
max time network
118s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
Size

205KB
MD5

9bcde83b02d301d3f6408867d95aa67d
SHA1

1c7755486a31e4a1e6fdcdc0c2991feb7f42f971
SHA256

18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a
SHA512

07acd76840b2910235b2bed319ff6b6e34396bc96994a47d1c5aacd4d7fecd3c96c63554f1765620820097435e17ef48a204e3f1dbbd3ebdc72041ab7000c1bf
SSDEEP

3072:rqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:rqhMPssRARoiSoS3SsQLH5AK

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

services.exe lsass.exe smss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

lsass.exe smss.exe csrss.exescwg.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

scwg.exeservices.exe lsass.exe smss.exe csrss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	scwg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

csrss.exescwg.exeservices.exe lsass.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	scwg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

services.exe lsass.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

Disables RegEdit via registry modification 3 IoCs

evasion

Processes:

services.exe lsass.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 64 IoCs

Processes:

18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe csrss.execsrss.exe csrss.execsrss.exe scwg.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe winlogon.exewinlogon.exe csrss.execsrss.exe smss.exelsass.exeservices.exewinlogon.exesmss.exesmss.exe services.exe winlogon.exe ~Paraysutki_VM_Community~smss.exe lsass.exe lsass.exe~Paraysutki_VM_Community~services.exelsass.exe services.exe winlogon.exelsass.exewinlogon.exe lsass.exe services.exewinlogon.exe~Paraysutki_VM_Community~services.exe~Paraysutki_VM_Community~winlogon.exe services.exe winlogon.exewinlogon.exe~Paraysutki_VM_Community~

pid	process
1900	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
1928	csrss.exe
1204	csrss.exe
1972	csrss.exe
1836	csrss.exe
1980	scwg.exe
1672	smss.exe
576	smss.exe
668	csrss.exe
1380	csrss.exe
564	smss.exe
1140	smss.exe
1912	lsass.exe
1524	lsass.exe
1512	csrss.exe
2032	csrss.exe
1612	smss.exe
1176	smss.exe
1904	lsass.exe
1828	lsass.exe
2016	services.exe
1752	services.exe
1180	csrss.exe
1776	csrss.exe
1652	smss.exe
1276	smss.exe
888	lsass.exe
1968	lsass.exe
1156	services.exe
1160	services.exe
268	winlogon.exe
608	winlogon.exe
452	csrss.exe
1660	csrss.exe
1196	smss.exe
976	lsass.exe
468	services.exe
1384	winlogon.exe
1396	smss.exe
768	smss.exe
924	services.exe
2044	winlogon.exe
2032	~Paraysutki_VM_Community~
1588	smss.exe
964	lsass.exe
1984	lsass.exe
1068	~Paraysutki_VM_Community~
1836	services.exe
1652	lsass.exe
1956	services.exe
108	winlogon.exe
824	lsass.exe
1224	winlogon.exe
668	lsass.exe
2040	services.exe
1948	winlogon.exe
1672	~Paraysutki_VM_Community~
1976	services.exe
1496	~Paraysutki_VM_Community~
1716	winlogon.exe
584	services.exe
964	winlogon.exe
1968	winlogon.exe
1220	~Paraysutki_VM_Community~

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

lsass.exe smss.exe services.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "rundll32.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe\Debugger = "cmd.exe /c del"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rundll32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "rundll32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe\Debugger = "cmd.exe /c del"	lsass.exe

Loads dropped DLL 64 IoCs

Processes:

pid	process
552	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
552	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
1900	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
1900	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1204	csrss.exe
1204	csrss.exe
1204	csrss.exe
1972	csrss.exe
1972	csrss.exe
1836	csrss.exe
1972	csrss.exe
1972	csrss.exe
1204	csrss.exe
1204	csrss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
576	smss.exe
576	smss.exe
576	smss.exe
668	csrss.exe
668	csrss.exe
1380	csrss.exe
576	smss.exe
576	smss.exe
564	smss.exe
564	smss.exe
1140	smss.exe
576	smss.exe
576	smss.exe
1912	lsass.exe
1912	lsass.exe
1912	lsass.exe
1524	lsass.exe
1524	lsass.exe
1524	lsass.exe
1512	csrss.exe
1512	csrss.exe
2032	csrss.exe
1524	lsass.exe
1524	lsass.exe
1612	smss.exe
1612	smss.exe
1176	smss.exe
1524	lsass.exe
1524	lsass.exe
1904	lsass.exe
1904	lsass.exe
1828	lsass.exe
1524	lsass.exe
1524	lsass.exe
2016	services.exe
2016	services.exe
2016	services.exe
1752	services.exe
1752	services.exe
1752	services.exe
1180	csrss.exe
1180	csrss.exe
1776	csrss.exe
1752	services.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

services.exe smss.exe lsass.exe scwg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BaRloNdDiLhep = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\services.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UpDaTer = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\csrss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	scwg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ViSulaBaCis = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\lsass.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RealTimeProtector = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDOwsUPdate = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~²\\smss.exe"	lsass.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

services.exe lsass.exe smss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

scwg.exe

description	ioc	process
File opened (read-only)	\??\K:	scwg.exe
File opened (read-only)	\??\L:	scwg.exe
File opened (read-only)	\??\M:	scwg.exe
File opened (read-only)	\??\V:	scwg.exe
File opened (read-only)	\??\X:	scwg.exe
File opened (read-only)	\??\B:	scwg.exe
File opened (read-only)	\??\F:	scwg.exe
File opened (read-only)	\??\H:	scwg.exe
File opened (read-only)	\??\I:	scwg.exe
File opened (read-only)	\??\O:	scwg.exe
File opened (read-only)	\??\P:	scwg.exe
File opened (read-only)	\??\T:	scwg.exe
File opened (read-only)	\??\W:	scwg.exe
File opened (read-only)	\??\E:	scwg.exe
File opened (read-only)	\??\G:	scwg.exe
File opened (read-only)	\??\Y:	scwg.exe
File opened (read-only)	\??\S:	scwg.exe
File opened (read-only)	\??\U:	scwg.exe
File opened (read-only)	\??\Q:	scwg.exe
File opened (read-only)	\??\R:	scwg.exe
File opened (read-only)	\??\Z:	scwg.exe
File opened (read-only)	\??\J:	scwg.exe
File opened (read-only)	\??\N:	scwg.exe

Drops file in System32 directory 64 IoCs

Processes:

smss.execsrss.exe smss.exe18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe smss.exe ~Paraysutki_VM_Community~lsass.exe scwg.execsrss.exelsass.execsrss.exewinlogon.exe csrss.exeservices.exe services.exesmss.exelsass.exeservices.exelsass.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	~Paraysutki_VM_Community~
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	csrss.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	scwg.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	csrss.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	scwg.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe	smss.exe

Drops file in Program Files directory 34 IoCs

Processes:

scwg.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	scwg.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	scwg.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	scwg.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	scwg.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	scwg.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	scwg.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

smss.exe services.exe lsass.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	lsass.exe

Modifies registry class 42 IoCs

Processes:

scwg.exeservices.exe csrss.exelsass.exe smss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	scwg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	scwg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	scwg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	scwg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	scwg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	scwg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	scwg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	scwg.exe

Runs ping.exe 1 TTPs 18 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
1112	ping.exe
432	ping.exe
860	ping.exe
2296	ping.exe
1432	ping.exe
1356	ping.exe
1080	ping.exe
980	ping.exe
1140	ping.exe
2244	ping.exe
2308	ping.exe
1504	ping.exe
2028	ping.exe
1656	ping.exe
1276	ping.exe
1060	ping.exe
1904	ping.exe
2012	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

csrss.exesmss.exe

pid	process
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1928	csrss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe
1672	smss.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe csrss.execsrss.exe csrss.execsrss.exe scwg.exesmss.exesmss.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe csrss.execsrss.exe smss.exesmss.exe lsass.exelsass.exe services.exeservices.exe winlogon.exewinlogon.exe csrss.execsrss.exe smss.exeservices.exewinlogon.exesmss.exesmss.exe winlogon.exe services.exe lsass.exe~Paraysutki_VM_Community~lsass.exe smss.exe ~Paraysutki_VM_Community~lsass.exeservices.exeservices.exe winlogon.exelsass.exe lsass.exelsass.exe winlogon.exe services.exewinlogon.exeservices.exeservices.exe winlogon.exe winlogon.exewinlogon.exewinlogon.exe

pid	process
552	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
1900	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
1928	csrss.exe
1204	csrss.exe
1972	csrss.exe
1836	csrss.exe
1980	scwg.exe
1672	smss.exe
576	smss.exe
668	csrss.exe
1380	csrss.exe
564	smss.exe
1140	smss.exe
1912	lsass.exe
1524	lsass.exe
1512	csrss.exe
2032	csrss.exe
1612	smss.exe
1176	smss.exe
1904	lsass.exe
1828	lsass.exe
2016	services.exe
1752	services.exe
1180	csrss.exe
1776	csrss.exe
1652	smss.exe
1276	smss.exe
888	lsass.exe
1968	lsass.exe
1156	services.exe
1160	services.exe
268	winlogon.exe
608	winlogon.exe
452	csrss.exe
1660	csrss.exe
1196	smss.exe
468	services.exe
1384	winlogon.exe
1396	smss.exe
768	smss.exe
2044	winlogon.exe
924	services.exe
976	lsass.exe
2032	~Paraysutki_VM_Community~
964	lsass.exe
1588	smss.exe
1068	~Paraysutki_VM_Community~
1984	lsass.exe
1836	services.exe
1956	services.exe
108	winlogon.exe
1652	lsass.exe
824	lsass.exe
668	lsass.exe
1224	winlogon.exe
2040	services.exe
1948	winlogon.exe
1672
1976	services.exe
584	services.exe
1716	winlogon.exe
1968	winlogon.exe
964	winlogon.exe
1528	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 552 wrote to memory of 1900	552	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
PID 552 wrote to memory of 1900	552	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
PID 552 wrote to memory of 1900	552	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
PID 552 wrote to memory of 1900	552	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
PID 1900 wrote to memory of 1928	1900	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe	csrss.exe
PID 1900 wrote to memory of 1928	1900	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe	csrss.exe
PID 1900 wrote to memory of 1928	1900	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe	csrss.exe
PID 1900 wrote to memory of 1928	1900	18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe	csrss.exe
PID 1928 wrote to memory of 1204	1928	csrss.exe	csrss.exe
PID 1928 wrote to memory of 1204	1928	csrss.exe	csrss.exe
PID 1928 wrote to memory of 1204	1928	csrss.exe	csrss.exe
PID 1928 wrote to memory of 1204	1928	csrss.exe	csrss.exe
PID 1204 wrote to memory of 1972	1204	csrss.exe	csrss.exe
PID 1204 wrote to memory of 1972	1204	csrss.exe	csrss.exe
PID 1204 wrote to memory of 1972	1204	csrss.exe	csrss.exe
PID 1204 wrote to memory of 1972	1204	csrss.exe	csrss.exe
PID 1972 wrote to memory of 1836	1972	csrss.exe	csrss.exe
PID 1972 wrote to memory of 1836	1972	csrss.exe	csrss.exe
PID 1972 wrote to memory of 1836	1972	csrss.exe	csrss.exe
PID 1972 wrote to memory of 1836	1972	csrss.exe	csrss.exe
PID 1972 wrote to memory of 1980	1972	csrss.exe	scwg.exe
PID 1972 wrote to memory of 1980	1972	csrss.exe	scwg.exe
PID 1972 wrote to memory of 1980	1972	csrss.exe	scwg.exe
PID 1972 wrote to memory of 1980	1972	csrss.exe	scwg.exe
PID 1204 wrote to memory of 1672	1204	csrss.exe	smss.exe
PID 1204 wrote to memory of 1672	1204	csrss.exe	smss.exe
PID 1204 wrote to memory of 1672	1204	csrss.exe	smss.exe
PID 1204 wrote to memory of 1672	1204	csrss.exe	smss.exe
PID 1672 wrote to memory of 576	1672	smss.exe	smss.exe
PID 1672 wrote to memory of 576	1672	smss.exe	smss.exe
PID 1672 wrote to memory of 576	1672	smss.exe	smss.exe
PID 1672 wrote to memory of 576	1672	smss.exe	smss.exe
PID 576 wrote to memory of 668	576	smss.exe	csrss.exe
PID 576 wrote to memory of 668	576	smss.exe	csrss.exe
PID 576 wrote to memory of 668	576	smss.exe	csrss.exe
PID 576 wrote to memory of 668	576	smss.exe	csrss.exe
PID 668 wrote to memory of 1380	668	csrss.exe	csrss.exe
PID 668 wrote to memory of 1380	668	csrss.exe	csrss.exe
PID 668 wrote to memory of 1380	668	csrss.exe	csrss.exe
PID 668 wrote to memory of 1380	668	csrss.exe	csrss.exe
PID 576 wrote to memory of 564	576	smss.exe	smss.exe
PID 576 wrote to memory of 564	576	smss.exe	smss.exe
PID 576 wrote to memory of 564	576	smss.exe	smss.exe
PID 576 wrote to memory of 564	576	smss.exe	smss.exe
PID 564 wrote to memory of 1140	564	smss.exe	smss.exe
PID 564 wrote to memory of 1140	564	smss.exe	smss.exe
PID 564 wrote to memory of 1140	564	smss.exe	smss.exe
PID 564 wrote to memory of 1140	564	smss.exe	smss.exe
PID 576 wrote to memory of 1912	576	smss.exe	lsass.exe
PID 576 wrote to memory of 1912	576	smss.exe	lsass.exe
PID 576 wrote to memory of 1912	576	smss.exe	lsass.exe
PID 576 wrote to memory of 1912	576	smss.exe	lsass.exe
PID 1912 wrote to memory of 1524	1912	lsass.exe	lsass.exe
PID 1912 wrote to memory of 1524	1912	lsass.exe	lsass.exe
PID 1912 wrote to memory of 1524	1912	lsass.exe	lsass.exe
PID 1912 wrote to memory of 1524	1912	lsass.exe	lsass.exe
PID 1524 wrote to memory of 1512	1524	lsass.exe	csrss.exe
PID 1524 wrote to memory of 1512	1524	lsass.exe	csrss.exe
PID 1524 wrote to memory of 1512	1524	lsass.exe	csrss.exe
PID 1524 wrote to memory of 1512	1524	lsass.exe	csrss.exe
PID 1512 wrote to memory of 2032	1512	csrss.exe	csrss.exe
PID 1512 wrote to memory of 2032	1512	csrss.exe	csrss.exe
PID 1512 wrote to memory of 2032	1512	csrss.exe	csrss.exe
PID 1512 wrote to memory of 2032	1512	csrss.exe	csrss.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

services.exe lsass.exe smss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

C:\Users\Admin\AppData\Local\Temp\18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
"C:\Users\Admin\AppData\Local\Temp\18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552

C:\Users\Admin\AppData\Local\Temp\18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
C:\Users\Admin\AppData\Local\Temp\18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
5⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1836

\??\c:\Documents and Settings\Admin\Application Data\Microsoft\scwg.exe
"c:\Documents and Settings\Admin\Application Data\Microsoft\scwg.exe" csrss
6⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
6⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:576

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1140

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
8⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1524

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2032

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1612

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1176

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1904

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1828

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
10⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1752

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1180

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1776

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:888

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1156

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1160

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:268

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:608

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:452

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1588

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:824

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:668

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
14⤵
- Suspicious use of SetWindowsHookEx
PID:1528

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
13⤵
PID:1508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
13⤵
PID:1500

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
13⤵
- Runs ping.exe
PID:860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
13⤵
PID:1012

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
13⤵
- Runs ping.exe
PID:1080

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
13⤵
- Runs ping.exe
PID:2028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
13⤵
PID:1748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
13⤵
PID:2140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
13⤵
PID:2184

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
13⤵
PID:2208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
13⤵
PID:2228

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
11⤵
PID:2000

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:1112

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
11⤵
- Runs ping.exe
PID:432

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
11⤵
- Runs ping.exe
PID:1432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
11⤵
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
11⤵
PID:108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
11⤵
PID:1880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
11⤵
PID:1652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
11⤵
PID:1572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
11⤵
PID:1664

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1384

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2044

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
9⤵
PID:1828

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
9⤵
PID:552

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
9⤵
- Runs ping.exe
PID:1356

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:1504

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
9⤵
- Runs ping.exe
PID:1060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
9⤵
PID:292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
9⤵
PID:1656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
9⤵
PID:1332

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
9⤵
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
9⤵
PID:1612

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:468

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:924

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:108

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1224

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
7⤵
- Executes dropped EXE
PID:1496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
7⤵
PID:1104

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
7⤵
PID:1964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
7⤵
PID:1588

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
7⤵
- Runs ping.exe
PID:1656

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:1904

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
7⤵
- Runs ping.exe
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
7⤵
PID:2172

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
7⤵
PID:2272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
7⤵
PID:2424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
7⤵
PID:2476

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:976

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1836

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1956

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1948

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
5⤵
- Executes dropped EXE
PID:1220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
5⤵
PID:820

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:1276

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
5⤵
- Runs ping.exe
PID:1140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
5⤵
PID:552

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
5⤵
- Runs ping.exe
PID:980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
5⤵
PID:2084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
5⤵
PID:2196

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
5⤵
PID:2384

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
5⤵
PID:2452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
5⤵
PID:2508

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:768

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
4⤵
PID:1672

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
3⤵
- Executes dropped EXE
PID:1672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
3⤵
PID:1332

C:\Windows\SysWOW64\ping.exe
ping www.duniasex.com -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:2244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
3⤵
PID:2316

C:\Windows\SysWOW64\ping.exe
ping www.rasasayang.com.my -n 65500 -l 1210
3⤵
- Runs ping.exe
PID:2308

C:\Windows\SysWOW64\ping.exe
ping www.data0.net -n 65500 -l 1340
3⤵
- Runs ping.exe
PID:2296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
3⤵
PID:2432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
3⤵
PID:2484

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im tati.exe
3⤵
PID:2524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im wscript.exe
3⤵
PID:2548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe taskkill /f /im sys.exe
3⤵
PID:2560

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\scwg.exe

Filesize
76KB

MD5
6fd58ac4bd7aac8224563daf1d17b2d6

SHA1
af2addc4c1447ef991a4f16616db51d7d18bf6e9

SHA256
10d9468188291a85d71c8a52ec5dff11fc72f92eeb1036ac33c9b6cd56c24a03

SHA512
056037f626ecfa38e0f724c08eefbba8fbf16bc0edbfe0a0fd64e409080f567a67f53af0da74df50cbb70168c9259b2e6a5740d6d177f70b7934798748bb3524

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\scwg.exe

Filesize
76KB

MD5
6fd58ac4bd7aac8224563daf1d17b2d6

SHA1
af2addc4c1447ef991a4f16616db51d7d18bf6e9

SHA256
10d9468188291a85d71c8a52ec5dff11fc72f92eeb1036ac33c9b6cd56c24a03

SHA512
056037f626ecfa38e0f724c08eefbba8fbf16bc0edbfe0a0fd64e409080f567a67f53af0da74df50cbb70168c9259b2e6a5740d6d177f70b7934798748bb3524

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
d745a3edc8fdc3eb382f371efc17ae29

SHA1
46d0c32e98dfb62ac48d49b2035f4eda0762f32e

SHA256
0af7b56b387a2b0dcc1ba90cb8a02279cd2d5026c7feacb046fc487d6979c862

SHA512
5144d3621a3936aa18318718b1243790a07e1ce21fa5d4550e9919b849853660e7d033dbec1d7a1599635bcef0999bedf2586464857695b246bf23293143e9a0

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Local\Temp\18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Users\Admin\AppData\Local\Temp\18b9f7f4c8dbccacb15f13039655826e91c953347c4d36b6f847889b93bd4b7a.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\scwg.exe

Filesize
76KB

MD5
6fd58ac4bd7aac8224563daf1d17b2d6

SHA1
af2addc4c1447ef991a4f16616db51d7d18bf6e9

SHA256
10d9468188291a85d71c8a52ec5dff11fc72f92eeb1036ac33c9b6cd56c24a03

SHA512
056037f626ecfa38e0f724c08eefbba8fbf16bc0edbfe0a0fd64e409080f567a67f53af0da74df50cbb70168c9259b2e6a5740d6d177f70b7934798748bb3524

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\scwg.exe

Filesize
76KB

MD5
6fd58ac4bd7aac8224563daf1d17b2d6

SHA1
af2addc4c1447ef991a4f16616db51d7d18bf6e9

SHA256
10d9468188291a85d71c8a52ec5dff11fc72f92eeb1036ac33c9b6cd56c24a03

SHA512
056037f626ecfa38e0f724c08eefbba8fbf16bc0edbfe0a0fd64e409080f567a67f53af0da74df50cbb70168c9259b2e6a5740d6d177f70b7934798748bb3524

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
205KB

MD5
ecd2f8ed83c84bff9ffe3715e2d48bef

SHA1
a954e147d3057d7ee15714188af110662f5056b0

SHA256
5b7ee6f65b91c93b540b5af4d4858c767066540aa953de81669d5ba6abaf9ad8

SHA512
3cbe62e8a22d767fd5b02f3a521b464985faf1b094d0398c2af9576ab7ce631a82e7dcddc960bded35bf8d152afd51b355e2ddc60f06a14b2d8e3b2adead1476

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe

Filesize
129KB

MD5
e2c33f1d5b2c10d0fff92ec379577f06

SHA1
db52e7c71eb6e99ad6fa38305a7c62337246cc9e

SHA256
6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

SHA512
6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

Download Submit
memory/108-312-0x0000000000000000-mapping.dmp

Download
memory/268-231-0x0000000000000000-mapping.dmp

Download
memory/432-328-0x0000000000000000-mapping.dmp

Download
memory/452-237-0x0000000000000000-mapping.dmp

Download
memory/468-290-0x00000000002D0000-0x00000000002FA000-memory.dmp

Filesize
168KB

Download
memory/468-248-0x0000000000000000-mapping.dmp

Download
memory/552-63-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/552-62-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/564-147-0x0000000000000000-mapping.dmp

Download
memory/576-125-0x0000000000000000-mapping.dmp

Download
memory/576-170-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/576-418-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/584-362-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/608-243-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/608-234-0x0000000000000000-mapping.dmp

Download
memory/668-132-0x0000000000000000-mapping.dmp

Download
memory/668-336-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/668-321-0x0000000000000000-mapping.dmp

Download
memory/768-283-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/768-260-0x0000000000000000-mapping.dmp

Download
memory/824-314-0x0000000000000000-mapping.dmp

Download
memory/888-217-0x0000000000000000-mapping.dmp

Download
memory/924-261-0x0000000000000000-mapping.dmp

Download
memory/924-284-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/964-305-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/964-298-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/964-277-0x0000000000000000-mapping.dmp

Download
memory/976-247-0x0000000000000000-mapping.dmp

Download
memory/976-297-0x0000000000250000-0x000000000027A000-memory.dmp

Filesize
168KB

Download
memory/1068-295-0x0000000000000000-mapping.dmp

Download
memory/1112-327-0x0000000000000000-mapping.dmp

Download
memory/1140-155-0x0000000000000000-mapping.dmp

Download
memory/1140-160-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1156-224-0x0000000000000000-mapping.dmp

Download
memory/1160-227-0x0000000000000000-mapping.dmp

Download
memory/1160-230-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1176-183-0x0000000000000000-mapping.dmp

Download
memory/1176-186-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1180-202-0x0000000000000000-mapping.dmp

Download
memory/1196-246-0x0000000000000000-mapping.dmp

Download
memory/1196-289-0x00000000002C0000-0x00000000002EA000-memory.dmp

Filesize
168KB

Download
memory/1204-113-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1204-77-0x0000000000000000-mapping.dmp

Download
memory/1224-341-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1224-317-0x0000000000000000-mapping.dmp

Download
memory/1276-213-0x0000000000000000-mapping.dmp

Download
memory/1276-216-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1380-139-0x0000000000000000-mapping.dmp

Download
memory/1380-144-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1384-250-0x0000000000000000-mapping.dmp

Download
memory/1384-288-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/1396-293-0x00000000001C0000-0x00000000001EA000-memory.dmp

Filesize
168KB

Download
memory/1396-253-0x0000000000000000-mapping.dmp

Download
memory/1432-329-0x0000000000000000-mapping.dmp

Download
memory/1496-343-0x0000000000000000-mapping.dmp

Download
memory/1512-173-0x0000000000000000-mapping.dmp

Download
memory/1524-200-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1524-168-0x0000000000000000-mapping.dmp

Download
memory/1524-383-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1528-369-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1588-287-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1588-275-0x0000000000000000-mapping.dmp

Download
memory/1612-180-0x0000000000000000-mapping.dmp

Download
memory/1652-210-0x0000000000000000-mapping.dmp

Download
memory/1652-324-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1652-306-0x0000000000000000-mapping.dmp

Download
memory/1660-245-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1660-240-0x0000000000000000-mapping.dmp

Download
memory/1660-244-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1672-342-0x0000000000000000-mapping.dmp

Download
memory/1672-117-0x0000000000000000-mapping.dmp

Download
memory/1672-353-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1672-169-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1716-359-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1716-354-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1752-203-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1752-282-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1752-197-0x0000000000000000-mapping.dmp

Download
memory/1776-209-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1776-206-0x0000000000000000-mapping.dmp

Download
memory/1828-338-0x0000000000000000-mapping.dmp

Download
memory/1828-193-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1828-190-0x0000000000000000-mapping.dmp

Download
memory/1836-301-0x0000000000000000-mapping.dmp

Download
memory/1836-97-0x0000000000000000-mapping.dmp

Download
memory/1836-102-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1900-64-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1900-419-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1900-249-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1900-58-0x0000000000000000-mapping.dmp

Download
memory/1904-187-0x0000000000000000-mapping.dmp

Download
memory/1912-285-0x0000000000420000-0x000000000044A000-memory.dmp

Filesize
168KB

Download
memory/1912-163-0x0000000000000000-mapping.dmp

Download
memory/1928-112-0x0000000000320000-0x000000000034A000-memory.dmp

Filesize
168KB

Download
memory/1928-252-0x0000000000320000-0x000000000034A000-memory.dmp

Filesize
168KB

Download
memory/1928-251-0x0000000000320000-0x000000000034A000-memory.dmp

Filesize
168KB

Download
memory/1928-67-0x0000000000000000-mapping.dmp

Download
memory/1948-334-0x0000000000000000-mapping.dmp

Download
memory/1956-309-0x0000000000000000-mapping.dmp

Download
memory/1956-326-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1968-220-0x0000000000000000-mapping.dmp

Download
memory/1968-366-0x0000000000310000-0x000000000033A000-memory.dmp

Filesize
168KB

Download
memory/1968-223-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1972-115-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1972-89-0x0000000000000000-mapping.dmp

Download
memory/1980-105-0x0000000000000000-mapping.dmp

Download
memory/1984-286-0x0000000000000000-mapping.dmp

Download
memory/2000-291-0x0000000000000000-mapping.dmp

Download
memory/2016-201-0x0000000000330000-0x000000000035A000-memory.dmp

Filesize
168KB

Download
memory/2016-194-0x0000000000000000-mapping.dmp

Download
memory/2032-265-0x0000000000000000-mapping.dmp

Download
memory/2032-176-0x0000000000000000-mapping.dmp

Download
memory/2032-179-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2036-331-0x0000000000000000-mapping.dmp

Download
memory/2040-352-0x0000000000230000-0x000000000025A000-memory.dmp

Filesize
168KB

Download
memory/2040-330-0x0000000000000000-mapping.dmp

Download
memory/2044-302-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2044-292-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2044-264-0x0000000000000000-mapping.dmp

Download