b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
1796s
max time network
1800s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Worm/NadIote/Nadlote.exe
Size

240KB
MD5

57aecbcdcb3a5ad31ac07c5a62b56085
SHA1

a443c574f039828d237030bc18895027ca780337
SHA256

ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3
SHA512

7921f184411f898a78c7094176fa47368b1c6ba7d6a3f58df4332e6865325287f25622f1d13765fd08d499d34974461b2ee81319adc24ce3901cc72d132b3027
SSDEEP

6144:fFzclWnzp5DFV0FuS5hPGR/CnA1G+Ghgav/06hyTu:RcURxR/CnA0rhgaJy

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3012	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
2324	CMD.exe
2324	CMD.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\smss = "c:\\RECYCLER\\smss.exe "	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\smss = "c:\\RECYCLER\\smss.exe "	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops autorun.inf file 1 TTPs 6 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\c:\RECYCLER\autorun.INF	smss.exe
File opened for modification	\??\d:\autorun.INF	smss.exe
File opened for modification	\??\e:\autorun.INF	smss.exe
File opened for modification	\??\c:\autorun.INF	smss.exe
File opened for modification	\??\f:\autorun.INF	smss.exe
File opened for modification	\??\c:\RECYCLER:\autorun.INF	smss.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Messenger\msmsgs.exe	smss.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\smss.exe	Nadlote.exe
File opened for modification	C:\Windows\smss.exe	Nadlote.exe
File opened for modification	C:\Windows\smss.exe	smss.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
848	PING.EXE
1560	PING.EXE
1560	Process not Found
1804	PING.EXE
992	PING.EXE
2700	PING.EXE
1964	cmd.exe
1132	PING.EXE
2468	cmd.exe
2808	cmd.exe
1948	Process not Found
920	cmd.exe
2152	cmd.exe
2800	cmd.exe
1856	cmd.exe
836	PING.EXE
2560	cmd.exe
1948	cmd.exe
1904	cmd.exe
2716	Process not Found
1300	cmd.exe
564	PING.EXE
2084	cmd.exe
2920	cmd.exe
2600	Process not Found
2560	cmd.exe
2608	PING.EXE
3016	PING.EXE
908	cmd.exe
2196	PING.EXE
2012	cmd.exe
3048	PING.EXE
2900	PING.EXE
2480	Process not Found
2128	cmd.exe
1600	cmd.exe
1800	cmd.exe
1768	PING.EXE
1712	cmd.exe
2000	cmd.exe
1704	PING.EXE
2072	PING.EXE
2216	PING.EXE
2760	Process not Found
2580	cmd.exe
2740	PING.EXE
1108	cmd.exe
2288	cmd.exe
1192	PING.EXE
1720	PING.EXE
1252	PING.EXE
2744	cmd.exe
588	PING.EXE
2008	PING.EXE
2388	cmd.exe
1800	PING.EXE
2848	cmd.exe
2832	cmd.exe
2420	cmd.exe
696	Process not Found
2004	cmd.exe
2148	PING.EXE
2540	cmd.exe
888	PING.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2504	ipconfig.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2736	Process not Found
1616	reg.exe
1756	reg.exe
1280	reg.exe
1644	reg.exe
2100	reg.exe
2960	reg.exe
2592	reg.exe
1332	Process not Found
1036	reg.exe
2512	reg.exe
2052	reg.exe
1788	reg.exe
2632	reg.exe
2172	reg.exe
2840	reg.exe
2764	reg.exe
2636	reg.exe
1484	reg.exe
2132	reg.exe
2664	reg.exe
2468	reg.exe
1548	reg.exe
2732	reg.exe
3068	reg.exe
2668	reg.exe
2716	reg.exe
2024	reg.exe
2520	reg.exe
2080	reg.exe
2320	Process not Found
484	reg.exe
2400	Process not Found
2984	reg.exe
2508	reg.exe
860	reg.exe
2444	reg.exe
592	reg.exe
2828	reg.exe
2720	reg.exe
3004	reg.exe
2752	reg.exe
1432	reg.exe
2336	reg.exe
2096	reg.exe
1400	reg.exe
2856	reg.exe
2808	reg.exe
2744	reg.exe
2796	reg.exe
1772	reg.exe
2932	reg.exe
836	reg.exe
772	reg.exe
3060	reg.exe
1740	reg.exe
1348	reg.exe
2764	reg.exe
1752	reg.exe
2276	reg.exe
2732	reg.exe
1900	reg.exe
1096	Process not Found
1644	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\RECYCLER:\autorun.INF	smss.exe

Runs ping.exe 1 TTPs 60 IoCs

Remote System Discovery

T1018

pid	Process
1228	Process not Found
2600	Process not Found
836	PING.EXE
564	PING.EXE
340	PING.EXE
2032	PING.EXE
592	PING.EXE
1252	PING.EXE
1804	PING.EXE
2700	PING.EXE
1652	PING.EXE
2900	PING.EXE
1948	Process not Found
2148	PING.EXE
1132	PING.EXE
2504	PING.EXE
2984	PING.EXE
1704	PING.EXE
3048	PING.EXE
2348	PING.EXE
1800	PING.EXE
888	PING.EXE
2740	PING.EXE
768	PING.EXE
1720	PING.EXE
588	PING.EXE
2008	PING.EXE
1192	PING.EXE
2480	Process not Found
3028	PING.EXE
484	PING.EXE
2848	PING.EXE
2072	PING.EXE
1560	PING.EXE
1844	PING.EXE
2124	PING.EXE
2520	PING.EXE
1968	PING.EXE
1056	PING.EXE
2672	PING.EXE
1768	PING.EXE
1280	PING.EXE
2196	PING.EXE
2216	PING.EXE
320	PING.EXE
1796	PING.EXE
848	PING.EXE
2584	PING.EXE
2872	PING.EXE
848	PING.EXE
2640	PING.EXE
2724	PING.EXE
1156	PING.EXE
3016	PING.EXE
2608	PING.EXE
2112	PING.EXE
2624	PING.EXE
2476	PING.EXE
1660	PING.EXE
992	PING.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe
2408	Nadlote.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2408	Nadlote.exe
3012	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2964	2408	Nadlote.exe	28
PID 2408 wrote to memory of 2964	2408	Nadlote.exe	28
PID 2408 wrote to memory of 2964	2408	Nadlote.exe	28
PID 2408 wrote to memory of 2964	2408	Nadlote.exe	28
PID 2408 wrote to memory of 2324	2408	Nadlote.exe	30
PID 2408 wrote to memory of 2324	2408	Nadlote.exe	30
PID 2408 wrote to memory of 2324	2408	Nadlote.exe	30
PID 2408 wrote to memory of 2324	2408	Nadlote.exe	30
PID 2324 wrote to memory of 3012	2324	CMD.exe	33
PID 2324 wrote to memory of 3012	2324	CMD.exe	33
PID 2324 wrote to memory of 3012	2324	CMD.exe	33
PID 2324 wrote to memory of 3012	2324	CMD.exe	33
PID 2964 wrote to memory of 2684	2964	cmd.exe	32
PID 2964 wrote to memory of 2684	2964	cmd.exe	32
PID 2964 wrote to memory of 2684	2964	cmd.exe	32
PID 2964 wrote to memory of 2684	2964	cmd.exe	32
PID 3012 wrote to memory of 2760	3012	smss.exe	34
PID 3012 wrote to memory of 2760	3012	smss.exe	34
PID 3012 wrote to memory of 2760	3012	smss.exe	34
PID 3012 wrote to memory of 2760	3012	smss.exe	34
PID 2760 wrote to memory of 2872	2760	cmd.exe	36
PID 2760 wrote to memory of 2872	2760	cmd.exe	36
PID 2760 wrote to memory of 2872	2760	cmd.exe	36
PID 2760 wrote to memory of 2872	2760	cmd.exe	36
PID 3012 wrote to memory of 2808	3012	smss.exe	37
PID 3012 wrote to memory of 2808	3012	smss.exe	37
PID 3012 wrote to memory of 2808	3012	smss.exe	37
PID 3012 wrote to memory of 2808	3012	smss.exe	37
PID 3012 wrote to memory of 2680	3012	smss.exe	38
PID 3012 wrote to memory of 2680	3012	smss.exe	38
PID 3012 wrote to memory of 2680	3012	smss.exe	38
PID 3012 wrote to memory of 2680	3012	smss.exe	38
PID 3012 wrote to memory of 2960	3012	smss.exe	40
PID 3012 wrote to memory of 2960	3012	smss.exe	40
PID 3012 wrote to memory of 2960	3012	smss.exe	40
PID 3012 wrote to memory of 2960	3012	smss.exe	40
PID 2808 wrote to memory of 2664	2808	cmd.exe	43
PID 2808 wrote to memory of 2664	2808	cmd.exe	43
PID 2808 wrote to memory of 2664	2808	cmd.exe	43
PID 2808 wrote to memory of 2664	2808	cmd.exe	43
PID 2680 wrote to memory of 2496	2680	cmd.exe	44
PID 2680 wrote to memory of 2496	2680	cmd.exe	44
PID 2680 wrote to memory of 2496	2680	cmd.exe	44
PID 2680 wrote to memory of 2496	2680	cmd.exe	44
PID 2960 wrote to memory of 2504	2960	cmd.exe	45
PID 2960 wrote to memory of 2504	2960	cmd.exe	45
PID 2960 wrote to memory of 2504	2960	cmd.exe	45
PID 2960 wrote to memory of 2504	2960	cmd.exe	45
PID 2408 wrote to memory of 2564	2408	Nadlote.exe	46
PID 2408 wrote to memory of 2564	2408	Nadlote.exe	46
PID 2408 wrote to memory of 2564	2408	Nadlote.exe	46
PID 2408 wrote to memory of 2564	2408	Nadlote.exe	46
PID 2564 wrote to memory of 2944	2564	cmd.exe	48
PID 2564 wrote to memory of 2944	2564	cmd.exe	48
PID 2564 wrote to memory of 2944	2564	cmd.exe	48
PID 2564 wrote to memory of 2944	2564	cmd.exe	48
PID 3012 wrote to memory of 2828	3012	smss.exe	49
PID 3012 wrote to memory of 2828	3012	smss.exe	49
PID 3012 wrote to memory of 2828	3012	smss.exe	49
PID 3012 wrote to memory of 2828	3012	smss.exe	49
PID 2828 wrote to memory of 1096	2828	cmd.exe	51
PID 2828 wrote to memory of 1096	2828	cmd.exe	51
PID 2828 wrote to memory of 1096	2828	cmd.exe	51
PID 2828 wrote to memory of 1096	2828	cmd.exe	51

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Worm\NadIote\Nadlote.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Worm\NadIote\Nadlote.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2684
- C:\Windows\SysWOW64\CMD.exe
  CMD /C "c:\RECYCLER\smss.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2324
- - \??\c:\RECYCLER\smss.exe
    c:\RECYCLER\smss.exe
    3⤵
    - Executes dropped EXE
    - Drops autorun.inf file
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2872
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2664
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2496
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ipconfig > c:\RECYCLER\IP.dlx
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig
        5⤵
        Gathers network information
        
        PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1096
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net share Love2="c:\Documents and Settings" /unlimited | net share Love1=C:\Windows /unlimited | net share Love3=d:\ /unlimited
      4⤵
      PID:748
    - - C:\Windows\SysWOW64\net.exe
        
        net share Love2="c:\Documents and Settings" /unlimited
        5⤵
        
        PID:940
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share Love2="c:\Documents and Settings" /unlimited
        6⤵
        
        PID:2028
    - - C:\Windows\SysWOW64\net.exe
        
        net share Love1=C:\Windows /unlimited
        5⤵
        
        PID:556
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share Love1=C:\Windows /unlimited
        6⤵
        
        PID:340
    - - C:\Windows\SysWOW64\net.exe
        
        net share Love3=d:\ /unlimited
        5⤵
        
        PID:1844
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share Love3=d:\ /unlimited
        6⤵
        
        PID:2256
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "smss\smss.exe " /f
      4⤵
      PID:1080
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "smss\smss.exe " /f
        5⤵
        
        PID:1108
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:848
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2248
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L0 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2000
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L0 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:1796
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2804
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2132
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:808
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2588
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:3028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2080
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:3004
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1628
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:920
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1768
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1504
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2904
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1712
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1520
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2916
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2136
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2756
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2628
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2516
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2812
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1524
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:572
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:600
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:1432
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:332
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2312
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:940
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:112
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2272
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2276
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L3 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2468
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L3 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:848
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1004
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2796
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2692
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2928
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2844
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2132
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1512
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2252
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1088
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:3000
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L4 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2348
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L4 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:3028
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1636
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:316
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1752
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2232
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2200
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2092
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2372
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1560
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2936
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L5 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2920
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L5 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2984
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2964
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2196
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2632
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2756
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2136
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2728
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2808
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L6 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2536
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L6 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:1652
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2548
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1428
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:644
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:584
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1484
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:600
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2988
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1476
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:556
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1592
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L7 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1300
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L7 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1252
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1996
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:620
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2796
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2676
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2732
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2132
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2844
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2884
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2128
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L8 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2560
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L8 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:836
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3000
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3028
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1552
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1744
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1536
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1404
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1636
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2164
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:816
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2096
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L9 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1712
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L9 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2112
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2908
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2936
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2424
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2684
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2920
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2832
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2120
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2752
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2740
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2764
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L10 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2808
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L10 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2008
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2496
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2488
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2580
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2828
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1032
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1304
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2568
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1432
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1080
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L11 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2012
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L11 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:1844
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1452
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:736
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2396
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1704
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2700
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2368
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1608
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2084
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L12 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2128
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L12 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:888
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2284
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1576
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1548
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3056
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1404
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2240
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2208
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L13 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2096
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L13 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:564
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1508
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2936
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2112
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2984
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2052
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2352
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2500
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:356
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2776
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L14 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:1848
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L14 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2640
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2728
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2496
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:952
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2672
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2308
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2944
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2536
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:692
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1108
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L15 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2612
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L15 -n 2 -w 3
        5⤵
        System Location Discovery: System Language Discovery
        Runs ping.exe
        
        PID:2724
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1732
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1780
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1796
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1992
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1924
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2696
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2900
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2520
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L16 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2004
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L16 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2624
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1092
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2128
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1576
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2252
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:3060
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1744
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:768
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:912
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:328
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L17 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:1812
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L17 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:1280
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1708
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1784
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1560
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2984
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2148
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2544
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2784
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2920
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2648
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:3048
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L18 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2744
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L18 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2516
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2508
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1848
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:952
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2512
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2492
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2548
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:536
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1432
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:600
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L19 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1108
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L19 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:484
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1040
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2524
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1960
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2012
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2700
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1252
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1608
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2132
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L19 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2848
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L19 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2476
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1644
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:444
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2852
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1548
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2004
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:108
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:924
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:896
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1628
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.0 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2320
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.0 -n 2 -w 3
        5⤵
        System Location Discovery: System Language Discovery
        Runs ping.exe
        
        PID:1660
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:992
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2336
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2088
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2296
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1812
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1720
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2040
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2544
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.1 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2152
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.1 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2196
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2976
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2752
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2636
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2728
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2660
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:3020
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:324
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.2 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2404
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.2 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2216
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2956
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:592
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1616
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1188
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1844
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1800
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1252
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.3 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2288
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.3 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2124
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2132
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2520
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2360
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:776
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1512
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1348
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:3056
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1156
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.4 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2108
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.4 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:768
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1540
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:3064
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2156
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:880
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2968
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2320
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1444
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2000
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2280
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.5 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:1968
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.5 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2148
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2912
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2916
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1740
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2584
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2908
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2976
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2500
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2508
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2488
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2376
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.6 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2872
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.6 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:320
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2564
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:936
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2828
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:600
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:536
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1144
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1964
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:596
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1188
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1524
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.7 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2012
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.7 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:340
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:184
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:1756
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2556
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1608
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1216
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2212
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1860
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1340
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:772
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.8 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2560
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.8 -n 2 -w 3
        5⤵
        System Location Discovery: System Language Discovery
        Runs ping.exe
        
        PID:1056
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1324
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2348
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1552
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:3004
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:860
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:768
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1904
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1784
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.9 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Location Discovery: System Language Discovery
      PID:620
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.9 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:848
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1720
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1808
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1296
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1560
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2676
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2424
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2684
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2572
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2648
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2352
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.10 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2540
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.10 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2516
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2744
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2760
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:408
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1096
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2960
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2628
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2956
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.11 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1948
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.11 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2032
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2524
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1524
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2720
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1944
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1492
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1300
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1924
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2840
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2192
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.12 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2056
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.12 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2520
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:3028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2316
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1512
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2252
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2560
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2688
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:3004
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1228
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.13 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1904
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.13 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:992
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1160
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1508
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1568
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1504
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1808
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2320
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2468
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:892
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1544
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.14 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2832
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.14 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3048
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1272
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2908
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2620
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2632
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1972
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2776
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1096
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2492
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.15 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2580
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.15 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:592
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:796
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2216
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2248
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2256
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2204
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2032
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1944
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1252
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L1.16 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1800
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L1.16 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1704
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1936
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2276
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2712
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1004
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2284
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2520
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2252
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.0 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2852
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.0 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:1156
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2100
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1752
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:896
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2208
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:880
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1904
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1976
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.1 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:1716
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.1 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1720
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1444
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1036
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2912
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2572
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:892
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2924
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2196
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2832
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2756
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.2 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2496
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.2 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2608
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1304
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2664
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2492
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1428
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2748
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2808
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:536
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2960
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1616
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1964
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.3 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:484
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.3 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1804
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1452
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1728
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2720
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2696
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1252
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2888
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1704
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1088
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.4 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2084
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.4 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2848
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:444
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2668
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2176
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:836
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:3056
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1552
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:1400
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1752
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1248
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.5 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1856
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.5 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2072
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:880
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2200
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:620
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1504
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2320
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1296
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2304
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2064
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1596
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.6 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2420
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.6 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2584
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2196
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2096
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2508
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2540
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2600
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2776
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1304
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2628
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1096
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.7 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2800
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.7 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3016
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:536
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2280
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2172
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1524
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1960
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1924
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.8 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1600
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.8 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2700
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1800
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1860
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2360
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1088
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1244
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:444
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:772
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:836
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:696
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.9 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:108
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.9 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2348
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:860
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2380
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2456
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1536
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1900
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2164
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2072
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:816
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.10 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2880
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.10 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1560
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1296
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2268
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:892
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2052
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2148
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:3008
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2120
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2060
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2604
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2776
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.11 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2152
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.11 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2672
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:932
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1428
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:936
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2828
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2812
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2568
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:940
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1700
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.12 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1964
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.12 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:588
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1252
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2728
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2844
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:1788
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2952
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2520
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.13 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:908
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.13 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:772
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2736
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1576
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2188
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:1404
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2108
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:768
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:1752
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.14 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:704
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.14 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2164
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2468
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:620
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1148
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1064
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2592
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2480
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2984
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2544
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        
        PID:2148
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.15 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:1632
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.15 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2476
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2752
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2964
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2604
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2876
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1432
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L2.16 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2388
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L2.16 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:2872
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1052
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:1484
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:332
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:112
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1700
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:484
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1948
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2932
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:2212
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter L3.0 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:2328
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter L3.0 -n 2 -w 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1800
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2132
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        
        PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1004
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1576
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:3032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2156
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2944
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2016
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:736
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2288
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1340
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1740
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1304
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1992
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1528
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2852
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1280
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:704
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2152
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1428
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2724
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2852
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1160
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1280
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2572
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1480
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2288
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2392
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1536
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:3068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:332
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:596
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1796
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1228
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:880
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1296
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2148
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2168
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1988
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1920
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1268
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:3068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1716
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2120
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:332
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:112
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2668
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1536
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1528
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2152
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1432
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:332
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:184
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1552
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2592
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1036
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2064
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1848
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:112
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2012
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2668
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2624
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:816
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1740
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:940
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2012
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:340
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1140
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1740
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1140
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1908
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:912
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:1132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1160
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2664
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2216
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2396
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2852
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:912
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:3064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2596
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:2432
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1144
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Modifies registry key
    PID:592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:736
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1964
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\RECYCLER\Downloads.exe

Filesize
240KB

MD5
57aecbcdcb3a5ad31ac07c5a62b56085

SHA1
a443c574f039828d237030bc18895027ca780337

SHA256
ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3

SHA512
7921f184411f898a78c7094176fa47368b1c6ba7d6a3f58df4332e6865325287f25622f1d13765fd08d499d34974461b2ee81319adc24ce3901cc72d132b3027

Download Submit
C:\RECYCLER\autorun.INF

Filesize
379B

MD5
cba289891ec7b2f21bda3435f229537b

SHA1
791eb6ade5b072480020f649151d3309d7ef8714

SHA256
34e37c589c9cdfea750288f65d019afee10644722cc520f1e95febc5758fd4f0

SHA512
626b0ccb36d6dbe9c0fd18b3c7a3f0636fc840a7f02b81c7c1883a638044202d979d330efefbe8d891d7ec043c64ddd536beb25994dfbdc66244822a6cc6736f

Download Submit
\??\c:\RECYCLER\IP.dlx

Filesize
508B

MD5
7750f91565d59b1b208aed20fb93c842

SHA1
296354bab9cd7b8605b746e3b60b5e27db65cd23

SHA256
b611f79de3b1f31c91d6a6daeaa1c5208481007161bd0f12201cf1707ffc70fc

SHA512
0d6faf02b1be260885246b2601eea225c8a3d2bda243f73c01b10fa39eb9e075e948bd36bc11b8147ed49200fbed471a08b536970ebc4c4506711b48d580cd0c

Download Submit
\??\c:\RECYCLER\check_4_online.dlx

Filesize
78B

MD5
1aee8eddef535a3c072b7f520eaf5560

SHA1
adef396d2bf5e47ef40a8ebfd53ebba7476b108f

SHA256
18e39b4a5a91f2cf56367c2d7b53830881d5d885bcccc234219c39fd0af44353

SHA512
907237c3fcfbf310f423b3a44cc6dcb1ee1cff6ce2d996b36df1b04eb6d74a5b1ceae9b3f19367e831fc9a4ee908c583e1cf212a5f3e3539d4c1f1243ba1d787

Download Submit
memory/2112-351-0x0000000077930000-0x0000000077A2A000-memory.dmp

Filesize
1000KB

Download
memory/2112-350-0x0000000077810000-0x000000007792F000-memory.dmp

Filesize
1.1MB

Download
memory/2324-18-0x0000000000200000-0x0000000000245000-memory.dmp

Filesize
276KB

Download
memory/2324-98-0x0000000000200000-0x0000000000245000-memory.dmp

Filesize
276KB

Download
memory/2324-99-0x0000000000200000-0x0000000000245000-memory.dmp

Filesize
276KB

Download
memory/2324-19-0x0000000000200000-0x0000000000245000-memory.dmp

Filesize
276KB

Download
memory/2408-97-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2408-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3012-106-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads