Overview

overview

10

Static

static

3c100791ae...d9.exe

windows7-x64

10

3c100791ae...d9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    23s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 10:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe

  • Size

    127KB

  • MD5

    a328717e0e518b200ae9f9ecd6ccb89a

  • SHA1

    f52bd30443937265f7bc89edfe94d67f4d878637

  • SHA256

    3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9

  • SHA512

    d9bf03fc468e235a8724f7c07ab8af21f634a88a01c9668add84c6915811b869b4e71029ba7e0bda11ef52da4d2e55271c9e722fdbaeb45fd3a70d00a784e96a

  • SSDEEP

    1536:enqdu3rbBGy3G8V0iuoKYMUYU6U5jUdPQc+n35KZg8/nouy8Iu:eqYMPsLMYjUtQl78vout

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 14 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 14 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 14 IoCs
    evasion
  • UAC bypass 3 TTPs 12 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 12 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 64 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 11 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 60 IoCs
  • Runs ping.exe 1 TTPs 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 22 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe
    "C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe 
      C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe 
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Sets file execution options in registry
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1928
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:664
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
          4⤵
          • Modifies WinLogon for persistence
          • Modifies system executable filetype association
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Sets file execution options in registry
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1940
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
            5⤵
            • Modifies system executable filetype association
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:884
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1376
            • \??\c:\Documents and Settings\Admin\Application Data\Microsoft\izav.exe
              "c:\Documents and Settings\Admin\Application Data\Microsoft\izav.exe" csrss
              6⤵
              • Modifies system executable filetype association
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Enumerates connected drives
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:1464
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1156
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
              6⤵
              • Modifies WinLogon for persistence
              • Modifies system executable filetype association
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Sets file execution options in registry
              • Loads dropped DLL
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Drops file in System32 directory
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:920
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1908
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                  8⤵
                    PID:784
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1824
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                  7⤵
                    PID:916
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                    7⤵
                      PID:2060
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                        8⤵
                        • Drops file in System32 directory
                        PID:2152
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                          9⤵
                            PID:2200
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                              10⤵
                                PID:2216
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                              9⤵
                                PID:2320
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                  10⤵
                                    PID:2340
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                  9⤵
                                    PID:2368
                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                      10⤵
                                      • Modifies WinLogon for persistence
                                      • Modifies system executable filetype association
                                      • Modifies visibility of file extensions in Explorer
                                      • Modifies visiblity of hidden/system files in Explorer
                                      • UAC bypass
                                      • Disables RegEdit via registry modification
                                      • Sets file execution options in registry
                                      • Adds Run key to start application
                                      • Checks whether UAC is enabled
                                      • Drops file in System32 directory
                                      • Modifies Internet Explorer settings
                                      • Modifies registry class
                                      • System policy modification
                                      PID:2384
                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                        11⤵
                                          PID:2400
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                            12⤵
                                              PID:2436
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                            11⤵
                                              PID:2460
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                12⤵
                                                  PID:2476
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                11⤵
                                                  PID:2520
                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                    12⤵
                                                      PID:2548
                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                    11⤵
                                                    • Drops file in System32 directory
                                                    PID:2584
                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                      12⤵
                                                        PID:2608
                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                      11⤵
                                                        PID:2660
                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                          12⤵
                                                          • Modifies WinLogon for persistence
                                                          • Modifies system executable filetype association
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Modifies visiblity of hidden/system files in Explorer
                                                          • UAC bypass
                                                          • Disables RegEdit via registry modification
                                                          • Sets file execution options in registry
                                                          • Adds Run key to start application
                                                          • Checks whether UAC is enabled
                                                          • Drops file in System32 directory
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          • System policy modification
                                                          PID:2696
                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                            13⤵
                                                              PID:2732
                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                14⤵
                                                                  PID:2764
                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                13⤵
                                                                  PID:2820
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                    14⤵
                                                                      PID:2848
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                    13⤵
                                                                    • Drops file in System32 directory
                                                                    PID:3056
                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                      14⤵
                                                                        PID:2100
                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                      13⤵
                                                                        PID:2232
                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                          14⤵
                                                                            PID:2288
                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                          13⤵
                                                                            PID:1600
                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                              14⤵
                                                                                PID:2324
                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                              13⤵
                                                                                PID:2428
                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                13⤵
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                PID:2520
                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                13⤵
                                                                                • Runs ping.exe
                                                                                PID:2692
                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                13⤵
                                                                                • Runs ping.exe
                                                                                PID:2672
                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                13⤵
                                                                                • Runs ping.exe
                                                                                PID:2712
                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                            11⤵
                                                                              PID:2728
                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                              11⤵
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:2844
                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                              11⤵
                                                                              • Runs ping.exe
                                                                              PID:2824
                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                              ping www.data0.net -n 65500 -l 1340
                                                                              11⤵
                                                                              • Runs ping.exe
                                                                              PID:3044
                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                              11⤵
                                                                              • Runs ping.exe
                                                                              PID:2988
                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                          9⤵
                                                                            PID:3016
                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                              10⤵
                                                                                PID:2192
                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                              9⤵
                                                                                PID:2260
                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                  10⤵
                                                                                  • Drops file in System32 directory
                                                                                  PID:2328
                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                    11⤵
                                                                                      PID:2304
                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                        12⤵
                                                                                        • Modifies WinLogon for persistence
                                                                                        • Modifies system executable filetype association
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                        • UAC bypass
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Sets file execution options in registry
                                                                                        • Adds Run key to start application
                                                                                        • Checks whether UAC is enabled
                                                                                        • Drops file in System32 directory
                                                                                        • Modifies Internet Explorer settings
                                                                                        • Modifies registry class
                                                                                        • System policy modification
                                                                                        PID:2244
                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                          13⤵
                                                                                            PID:2340
                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                              14⤵
                                                                                                PID:2320
                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                              13⤵
                                                                                                PID:1600
                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                  14⤵
                                                                                                    PID:2516
                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                  13⤵
                                                                                                    PID:2012
                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                      14⤵
                                                                                                      • Modifies WinLogon for persistence
                                                                                                      • Modifies system executable filetype association
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                                      • UAC bypass
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • Sets file execution options in registry
                                                                                                      • Adds Run key to start application
                                                                                                      • Checks whether UAC is enabled
                                                                                                      • Drops file in System32 directory
                                                                                                      • Modifies Internet Explorer settings
                                                                                                      • Modifies registry class
                                                                                                      • System policy modification
                                                                                                      PID:2428
                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                        15⤵
                                                                                                          PID:2632
                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                            16⤵
                                                                                                              PID:2724
                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                            15⤵
                                                                                                              PID:2700
                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                16⤵
                                                                                                                  PID:2840
                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                15⤵
                                                                                                                  PID:2664
                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                    16⤵
                                                                                                                      PID:2944
                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                    15⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:652
                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                      16⤵
                                                                                                                        PID:2372
                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                      15⤵
                                                                                                                        PID:2224
                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                          16⤵
                                                                                                                            PID:2268
                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                          15⤵
                                                                                                                          • Drops file in System32 directory
                                                                                                                          PID:2272
                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                          15⤵
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          PID:1592
                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                          15⤵
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:2532
                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                          15⤵
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:2340
                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                          15⤵
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:2564
                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                      13⤵
                                                                                                                        PID:1600
                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                          14⤵
                                                                                                                            PID:2728
                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                          13⤵
                                                                                                                            PID:2664
                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                              14⤵
                                                                                                                                PID:2372
                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                              13⤵
                                                                                                                                PID:2928
                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                13⤵
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                PID:2684
                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                13⤵
                                                                                                                                • Runs ping.exe
                                                                                                                                PID:2372
                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                13⤵
                                                                                                                                • Runs ping.exe
                                                                                                                                PID:2200
                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                13⤵
                                                                                                                                • Runs ping.exe
                                                                                                                                PID:2248
                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                            11⤵
                                                                                                                              PID:840
                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                12⤵
                                                                                                                                  PID:2740
                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                11⤵
                                                                                                                                  PID:1940
                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                    12⤵
                                                                                                                                      PID:2304
                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                    11⤵
                                                                                                                                      PID:3100
                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                      11⤵
                                                                                                                                        PID:3416
                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                          12⤵
                                                                                                                                            PID:3432
                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                          11⤵
                                                                                                                                            PID:3452
                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                            11⤵
                                                                                                                                              PID:3472
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                              11⤵
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:3536
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                              11⤵
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:3528
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                              11⤵
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:3520
                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                          9⤵
                                                                                                                                            PID:3224
                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                            9⤵
                                                                                                                                              PID:3244
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                              9⤵
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:3304
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                              9⤵
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:3296
                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                              9⤵
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:3288
                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                          7⤵
                                                                                                                                            PID:2224
                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                              8⤵
                                                                                                                                                PID:2272
                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                              7⤵
                                                                                                                                                PID:2696
                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                7⤵
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                PID:2012
                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                7⤵
                                                                                                                                                • Runs ping.exe
                                                                                                                                                PID:3092
                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                7⤵
                                                                                                                                                • Runs ping.exe
                                                                                                                                                PID:3108
                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                7⤵
                                                                                                                                                • Runs ping.exe
                                                                                                                                                PID:3124
                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                            5⤵
                                                                                                                                              PID:2892
                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                6⤵
                                                                                                                                                  PID:2996
                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                5⤵
                                                                                                                                                  PID:2108
                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                    6⤵
                                                                                                                                                      PID:2196
                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                    5⤵
                                                                                                                                                      PID:2252
                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                        6⤵
                                                                                                                                                          PID:2272
                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                        5⤵
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        PID:2352
                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                        5⤵
                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                        PID:2364
                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                        5⤵
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:2500
                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                        5⤵
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:2476
                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                        5⤵
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:1972
                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                    3⤵
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    PID:2492
                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2508
                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2576
                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2616
                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                          3⤵
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          PID:2652
                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                            4⤵
                                                                                                                                                              PID:2684
                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            PID:2716
                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2740
                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2780
                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                3⤵
                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                PID:2812
                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                3⤵
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:2880
                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                3⤵
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:2908
                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                3⤵
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:2900
                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                            1⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:760
                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                            1⤵
                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                            • UAC bypass
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Sets file execution options in registry
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            • System policy modification
                                                                                                                                                            PID:652
                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2000
                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1976
                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:1120
                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:460
                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:1680
                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:536
                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                        PID:1956
                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:560
                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:696
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:1676
                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:1148
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:1472
                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                              5⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:952
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:628
                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:1132
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:1952
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:972
                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  PID:916
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:1780
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:1588
                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:432
                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:1900
                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  PID:556
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:1356
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:2040
                                                                                                                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:1124
                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                              PID:1516
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:1148
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:1080
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:1740
                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2008
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:1592
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:1116
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:880
                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:756
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:1512
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:2076
                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                              PID:2088
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:2028
                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:2040
                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:1556
                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:2036
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:784
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:1892
                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:1716
                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                  • Modifies system executable filetype association
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Sets file execution options in registry
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:1640
                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:1892
                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                      PID:1768
                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:2004
                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:112
                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:1588
                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:584
                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Sets file execution options in registry
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:892
                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:2008
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:1468
                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:2036
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                            • Modifies system executable filetype association
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Sets file execution options in registry
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:536
                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:604
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:756
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:2000
                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                              PID:1976
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:676
                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:1920
                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:780
                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                PID:2020
                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                PID:1556
                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                PID:1280
                                                                                                                                                                                              • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                PID:1424
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                            PID:1680
                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:756
                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              PID:1688
                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                              PID:1920
                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                              • Sets file execution options in registry
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                              PID:952
                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                              PID:784
                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1340
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                              PID:1780
                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "9699946523708680091218684359-685153626-677999295507206956-1540504578365395010"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:560
                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-13603474711427741676-213993658185077129-4547005812067620965-235645711-452359052"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:584

                                                                                                                                                                                          Network

                                                                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                          Initial Access

                                                                                                                                                                                          Execution

                                                                                                                                                                                          Persistence

                                                                                                                                                                                          Winlogon Helper DLL

                                                                                                                                                                                          1
                                                                                                                                                                                          T1004

                                                                                                                                                                                          Change Default File Association

                                                                                                                                                                                          1
                                                                                                                                                                                          T1042

                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                          2
                                                                                                                                                                                          T1158

                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                          2
                                                                                                                                                                                          T1060

                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                          1
                                                                                                                                                                                          T1088

                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                          9
                                                                                                                                                                                          T1112

                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                          2
                                                                                                                                                                                          T1158

                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                          1
                                                                                                                                                                                          T1088

                                                                                                                                                                                          Disabling Security Tools

                                                                                                                                                                                          1
                                                                                                                                                                                          T1089

                                                                                                                                                                                          Credential Access

                                                                                                                                                                                          Discovery

                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                          3
                                                                                                                                                                                          T1082

                                                                                                                                                                                          Query Registry

                                                                                                                                                                                          1
                                                                                                                                                                                          T1012

                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1120

                                                                                                                                                                                          Remote System Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1018

                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                          Collection

                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                          Command and Control

                                                                                                                                                                                          Impact

                                                                                                                                                                                          Inhibit System Recovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1490

                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                          Downloads

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\izav.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            76KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            18e10aa6bfd049b81379508b2bc88bc7

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            89c3ea367c82960749da5846086ebcd815efcd5a

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            5b4e6a1d55d5c3d159d8ed050c9a55834971854df8ec4ada750875a3d4092dc5

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            cbc944a9cd5e1eaf278f1a643112e1979ea137bf0f23a045eb9d4de6728e6001baa8a7e192aa79c2a66db01b8063ec595f9af0c8384bf806d2236d868b211a4c

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLL
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \??\c:\Documents and Settings\Admin\Application Data\Microsoft\izav.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            76KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            18e10aa6bfd049b81379508b2bc88bc7

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            89c3ea367c82960749da5846086ebcd815efcd5a

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            5b4e6a1d55d5c3d159d8ed050c9a55834971854df8ec4ada750875a3d4092dc5

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            cbc944a9cd5e1eaf278f1a643112e1979ea137bf0f23a045eb9d4de6728e6001baa8a7e192aa79c2a66db01b8063ec595f9af0c8384bf806d2236d868b211a4c

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\Windows 3D.scr
                                                                                                                                                                                            MD5

                                                                                                                                                                                            d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8B

                                                                                                                                                                                            MD5

                                                                                                                                                                                            24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8B

                                                                                                                                                                                            MD5

                                                                                                                                                                                            24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8B

                                                                                                                                                                                            MD5

                                                                                                                                                                                            24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8B

                                                                                                                                                                                            MD5

                                                                                                                                                                                            24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8B

                                                                                                                                                                                            MD5

                                                                                                                                                                                            24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8B

                                                                                                                                                                                            MD5

                                                                                                                                                                                            24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\3c100791aeb6811711ad24edeafbb3d70471a3ce5c7f3b3773e2ea72ef46f6d9.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Users\Admin\AppData\Roaming\Microsoft\izav.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            76KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            18e10aa6bfd049b81379508b2bc88bc7

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            89c3ea367c82960749da5846086ebcd815efcd5a

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            5b4e6a1d55d5c3d159d8ed050c9a55834971854df8ec4ada750875a3d4092dc5

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            cbc944a9cd5e1eaf278f1a643112e1979ea137bf0f23a045eb9d4de6728e6001baa8a7e192aa79c2a66db01b8063ec595f9af0c8384bf806d2236d868b211a4c

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Users\Admin\AppData\Roaming\Microsoft\izav.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            76KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            18e10aa6bfd049b81379508b2bc88bc7

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            89c3ea367c82960749da5846086ebcd815efcd5a

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            5b4e6a1d55d5c3d159d8ed050c9a55834971854df8ec4ada750875a3d4092dc5

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            cbc944a9cd5e1eaf278f1a643112e1979ea137bf0f23a045eb9d4de6728e6001baa8a7e192aa79c2a66db01b8063ec595f9af0c8384bf806d2236d868b211a4c

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            127KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            86ccb68739d5e8989aa7797bd6687558

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            08b54f456ac6f7762f4e773c642d86d98cb58870

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b84e56c4f16cc7dac05fb3e897df0838e5b157954f15b84219de789a02931bb6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5e5ec1c26f493e35d31e1465665de2a34cf1a43bf518af31ac21afa541ae188ddbd10c4cb370e0cd70e92da1022c23fefc9bd81933d4b155197a5bbf42075712

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            50KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            940d24de51296709ead002014ae37c40

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7cebaccaa9a213585f71d2a845ca7fd7d2c1cb7d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d9afef82aafa6709ca6879cdd7915e76999bc5b150301b3ccd73d7a8ef14c3b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6646e85234e44185762d30705a2baf591241ae25459700f4699f3931f72d9138723aa52da6a479c72d8e9b0366892584f660b9b14f54d8672279cce7c44e7c64

                                                                                                                                                                                            Download Submit
                                                                                                                                                                                          • memory/112-307-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/112-308-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/432-318-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/432-315-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/460-182-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/536-293-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/536-336-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/536-252-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/536-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/556-275-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/560-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/584-355-0x0000000000230000-0x0000000000259000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/584-319-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/628-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/652-171-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/652-165-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/652-374-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/664-64-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/696-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/756-362-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/756-341-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/760-157-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/760-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/784-238-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/784-136-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/784-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/884-86-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/892-358-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/892-356-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/892-322-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/916-255-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/916-144-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/916-256-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/916-249-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/920-170-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/920-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/952-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/952-254-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/952-283-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/952-274-0x0000000075D71000-0x0000000075D73000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/972-246-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1080-289-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1116-310-0x0000000000230000-0x0000000000259000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1116-288-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1116-309-0x0000000000230000-0x0000000000259000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1120-179-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1124-278-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1132-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1132-245-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1148-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1148-290-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1156-168-0x0000000000310000-0x0000000000339000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1156-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1156-166-0x0000000000310000-0x0000000000339000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1356-281-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1376-94-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1376-99-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1464-105-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1468-331-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1468-328-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1472-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1500-100-0x00000000001C0000-0x00000000001E9000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1516-285-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1556-211-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1556-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1588-311-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1588-271-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1592-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1640-312-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1640-294-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1640-369-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1676-218-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1676-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1680-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1680-250-0x0000000000240000-0x0000000000269000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1716-270-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1716-267-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1740-287-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1768-303-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1768-300-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1780-257-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1824-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1892-263-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1892-260-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1892-297-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1900-264-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1908-129-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1908-142-0x00000000001C0000-0x00000000001C6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            24KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1928-101-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1928-58-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1928-449-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1940-74-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1940-102-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1952-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1956-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1976-346-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1976-178-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/1976-175-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2000-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2004-304-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2008-325-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2008-277-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2028-188-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2028-191-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2036-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2036-225-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2040-282-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2040-204-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2040-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2060-381-0x0000000000230000-0x0000000000259000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2060-383-0x0000000000230000-0x0000000000259000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2100-464-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2152-382-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2216-384-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2340-389-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2384-412-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2436-398-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2476-405-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2548-413-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2548-414-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2608-423-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2616-424-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2660-466-0x00000000002A0000-0x00000000002C9000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2696-468-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2740-439-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2764-444-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2848-455-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/2996-457-0x0000000000400000-0x0000000000429000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download
                                                                                                                                                                                          • memory/3056-462-0x0000000000230000-0x0000000000259000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            164KB

                                                                                                                                                                                            Download