98b8c0b46fcd24848cd9c82d48de824ba399297fe67d1b5facaf2d1c8d6a057c

Analysis

max time kernel
59s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1008510c01ae812ac9411c6f1abca788.exe
Size

127KB
MD5

1008510c01ae812ac9411c6f1abca788
SHA1

a3009e0c6ee1027f7e8a89fa642508ee8a63a5d9
SHA256

98b8c0b46fcd24848cd9c82d48de824ba399297fe67d1b5facaf2d1c8d6a057c
SHA512

a1f885afb95626389132e5f0c7f6068abd50623898d43d2368d3c5d01ee93595c37e5833f828341ad316153bfac577d8a949e3e25926ed7b9a6459e073733a5a
SSDEEP

1536:7amlu3hbBGy3G8nhMpD7MUYU6U5jUdPQc+n35KZg8/nouy8Iu:7reMPd/MYjUtQl78vout

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	1008510c01ae812ac9411c6f1abca788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	ping.exe

Modifies visibility of file extensions in Explorer 2 TTPs 12 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ping.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	amaa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1008510c01ae812ac9411c6f1abca788.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ping.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	services.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 10 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1008510c01ae812ac9411c6f1abca788.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ping.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ping.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

UAC bypass 3 TTPs 10 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ping.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1008510c01ae812ac9411c6f1abca788.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ping.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe

Disables RegEdit via registry modification 10 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1008510c01ae812ac9411c6f1abca788.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ping.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ping.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	services.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe\Debugger = "cmd.exe /c del"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	ping.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	ping.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	ping.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\Debugger = "rundll32.exe"	1008510c01ae812ac9411c6f1abca788.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe\Debugger = "cmd.exe /c del"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	ping.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rundll32.exe"	ping.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	ping.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "rundll32.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe\Debugger = "cmd.exe /c del"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	ping.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	ping.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "rundll32.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rundll32.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe\Debugger = "cmd.exe /c del"	smss.exe

Executes dropped EXE 64 IoCs

pid	Process
1856	1008510c01ae812ac9411c6f1abca788.exe
4804	csrss.exe
3600	csrss.exe
2112	csrss.exe
912	csrss.exe
4296	amaa.exe
232	Conhost.exe
1484	smss.exe
1000	ping.exe
2560	csrss.exe
4840	smss.exe
4700	smss.exe
400	lsass.exe
3768	lsass.exe
3680	csrss.exe
2256	csrss.exe
3016	smss.exe
2352	smss.exe
2916	lsass.exe
1384	lsass.exe
3608	csrss.exe
3444	services.exe
3620	csrss.exe
4344	csrss.exe
4456	smss.exe
3668	smss.exe
4052	lsass.exe
3012	lsass.exe
2844	services.exe
2968	smss.exe
3328	winlogon.exe
3780	csrss.exe
5080	winlogon.exe
4396	lsass.exe
3416	lsass.exe
1000	ping.exe
4072	csrss.exe
4876	services.exe
2820	services.exe
4656	csrss.exe
1580	winlogon.exe
4016	smss.exe
2824	winlogon.exe
524	smss.exe
2916	lsass.exe
2400	rundll32.exe
652	winlogon.exe
1588	services.exe
4056	services.exe
4596	winlogon.exe
4968	winlogon.exe
4720	Paraysutki_VM_Community
3952	Paraysutki_VM_Community
4920	rundll32.exe
652	winlogon.exe
2384	Conhost.exe
2688	ping.exe
4028	smss.exe
868	smss.exe
2404	lsass.exe
4324	lsass.exe
684	services.exe
5076	services.exe
3608	csrss.exe

Loads dropped DLL 64 IoCs

pid	Process
4804	csrss.exe
3600	csrss.exe
2112	csrss.exe
912	csrss.exe
232	Conhost.exe
1484	smss.exe
1000	ping.exe
2560	csrss.exe
4840	smss.exe
4700	smss.exe
400	lsass.exe
3768	lsass.exe
3680	csrss.exe
2256	csrss.exe
3016	smss.exe
2352	smss.exe
2916	lsass.exe
1384	lsass.exe
3608	csrss.exe
3444	services.exe
3620	csrss.exe
4344	csrss.exe
4456	smss.exe
3668	smss.exe
4052	lsass.exe
3012	lsass.exe
2844	services.exe
2968	smss.exe
3328	winlogon.exe
3780	csrss.exe
5080	winlogon.exe
4396	lsass.exe
3416	lsass.exe
1000	ping.exe
4072	csrss.exe
4876	services.exe
2820	services.exe
4656	csrss.exe
1580	winlogon.exe
4016	smss.exe
2824	winlogon.exe
524	smss.exe
2916	lsass.exe
2400	rundll32.exe
652	winlogon.exe
1588	services.exe
4056	services.exe
4596	winlogon.exe
4968	winlogon.exe
4720	Paraysutki_VM_Community
3952	Paraysutki_VM_Community
4920	rundll32.exe
652	winlogon.exe
2384	Conhost.exe
2688	ping.exe
4028	smss.exe
868	smss.exe
2404	lsass.exe
4324	lsass.exe
684	services.exe
5076	services.exe
3608	csrss.exe
3780	csrss.exe
2620	smss.exe

Modifies system executable filetype association 2 TTPs 12 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	1008510c01ae812ac9411c6f1abca788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	1008510c01ae812ac9411c6f1abca788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	1008510c01ae812ac9411c6f1abca788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	1008510c01ae812ac9411c6f1abca788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	1008510c01ae812ac9411c6f1abca788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	1008510c01ae812ac9411c6f1abca788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NviDiaGT = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\lsass.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVManager = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\csrss.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NarmonVirusAnti = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\smss.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PaRaY_VM = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe"	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ConfigVir = "C:\\Windows\\System32\\~A~m~B~u~R~a~D~u~L~\\services.exe"	winlogon.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1008510c01ae812ac9411c6f1abca788.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	amaa.exe
File opened (read-only)	\??\W:	amaa.exe
File opened (read-only)	\??\X:	amaa.exe
File opened (read-only)	\??\G:	amaa.exe
File opened (read-only)	\??\O:	amaa.exe
File opened (read-only)	\??\Q:	amaa.exe
File opened (read-only)	\??\R:	amaa.exe
File opened (read-only)	\??\T:	amaa.exe
File opened (read-only)	\??\Y:	amaa.exe
File opened (read-only)	\??\V:	amaa.exe
File opened (read-only)	\??\B:	amaa.exe
File opened (read-only)	\??\H:	amaa.exe
File opened (read-only)	\??\I:	amaa.exe
File opened (read-only)	\??\L:	amaa.exe
File opened (read-only)	\??\M:	amaa.exe
File opened (read-only)	\??\E:	amaa.exe
File opened (read-only)	\??\J:	amaa.exe
File opened (read-only)	\??\K:	amaa.exe
File opened (read-only)	\??\P:	amaa.exe
File opened (read-only)	\??\N:	amaa.exe
File opened (read-only)	\??\S:	amaa.exe
File opened (read-only)	\??\Z:	amaa.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	ping.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	1008510c01ae812ac9411c6f1abca788.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	Conhost.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	Conhost.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	ping.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	lsass.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	ping.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	ping.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	winlogon.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	1008510c01ae812ac9411c6f1abca788.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	csrss.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	services.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	1008510c01ae812ac9411c6f1abca788.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	smss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	ping.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	services.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe	1008510c01ae812ac9411c6f1abca788.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	1008510c01ae812ac9411c6f1abca788.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	Paraysutki_VM_Community
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	csrss.exe
File opened for modification	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	ping.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community	smss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe	services.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe	winlogon.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe	csrss.exe
File created	C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe	csrss.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	amaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	amaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\private_browsing.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\setup_wm.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	amaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	amaa.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	amaa.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	amaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	1008510c01ae812ac9411c6f1abca788.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	ping.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	ping.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	services.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	1008510c01ae812ac9411c6f1abca788.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	services.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	ping.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "++++ Hey, Hokage/babon (AnbuTeamSampit), Is this My places, Wanna start a War ++++"	ping.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	amaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	amaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	1008510c01ae812ac9411c6f1abca788.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	amaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	amaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	ping.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	amaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	amaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	1008510c01ae812ac9411c6f1abca788.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	amaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	ping.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	amaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	ping.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
5452	ping.exe
6376	ping.exe
6364	ping.exe
4848	ping.exe
1304	ping.exe
7212	ping.exe
9468	ping.exe
5852	ping.exe
808	ping.exe
4604	ping.exe
32	ping.exe
5968	ping.exe
6356	ping.exe
6920	ping.exe
3952	ping.exe
10084	ping.exe
6036	ping.exe
8752	ping.exe
5228	ping.exe
5044	ping.exe
5460	ping.exe
5440	ping.exe
10116	ping.exe
11180	ping.exe
7736	ping.exe
5192	ping.exe
9112	ping.exe
9948	ping.exe
5484	ping.exe
4924	ping.exe
8172	ping.exe
11172	ping.exe
6092	ping.exe
6700	ping.exe
2688	ping.exe
7184	ping.exe
6992	ping.exe
8600	ping.exe
2732	ping.exe
468	ping.exe
2088	ping.exe
9136	ping.exe
8524	ping.exe
10124	ping.exe
10668	ping.exe
4124	ping.exe
1544	ping.exe
9776	ping.exe
7656	ping.exe
1664	ping.exe
8188	ping.exe
9320	ping.exe
2196	ping.exe
3756	ping.exe
7084	ping.exe
7944	ping.exe
3464	ping.exe
7628	ping.exe
4620	ping.exe
9144	ping.exe
9944	ping.exe
1000	ping.exe
6344	ping.exe
9996	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
5080	winlogon.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe
3608	csrss.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
544	rundll32.exe
4112	rundll32.exe
2068	rundll32.exe
2400	rundll32.exe
4036	rundll32.exe
5256	rundll32.exe
5568	rundll32.exe
5880	rundll32.exe
4920	rundll32.exe
2316	rundll32.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4720	1008510c01ae812ac9411c6f1abca788.exe
1856	1008510c01ae812ac9411c6f1abca788.exe
4804	csrss.exe
3600	csrss.exe
2112	csrss.exe
912	csrss.exe
4296	amaa.exe
232	Conhost.exe
1484	smss.exe
1000	ping.exe
2560	csrss.exe
4840	smss.exe
4700	smss.exe
400	lsass.exe
3768	lsass.exe
3680	csrss.exe
2256	csrss.exe
3016	smss.exe
2352	smss.exe
2916	lsass.exe
1384	lsass.exe
3608	csrss.exe
3444	services.exe
3620	csrss.exe
4344	csrss.exe
4456	smss.exe
3668	smss.exe
4052	lsass.exe
3012	lsass.exe
2844	services.exe
2968	smss.exe
3328	winlogon.exe
3780	csrss.exe
5080	winlogon.exe
4396	lsass.exe
3416	lsass.exe
1000	ping.exe
4876	services.exe
4072	csrss.exe
2820	services.exe
4656	csrss.exe
1580	winlogon.exe
4016	smss.exe
2824	winlogon.exe
524	smss.exe
2916	lsass.exe
2400	rundll32.exe
652	winlogon.exe
1588	services.exe
4056	services.exe
4596	winlogon.exe
4968	winlogon.exe
4720	Paraysutki_VM_Community
4920	rundll32.exe
652	winlogon.exe
2384	Conhost.exe
2688	ping.exe
4028	smss.exe
868	smss.exe
2404	lsass.exe
4324	lsass.exe
684	services.exe
5076	services.exe
3608	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 1856	4720	1008510c01ae812ac9411c6f1abca788.exe	91
PID 4720 wrote to memory of 1856	4720	1008510c01ae812ac9411c6f1abca788.exe	91
PID 4720 wrote to memory of 1856	4720	1008510c01ae812ac9411c6f1abca788.exe	91
PID 1856 wrote to memory of 4804	1856	1008510c01ae812ac9411c6f1abca788.exe	92
PID 1856 wrote to memory of 4804	1856	1008510c01ae812ac9411c6f1abca788.exe	92
PID 1856 wrote to memory of 4804	1856	1008510c01ae812ac9411c6f1abca788.exe	92
PID 4804 wrote to memory of 3600	4804	csrss.exe	93
PID 4804 wrote to memory of 3600	4804	csrss.exe	93
PID 4804 wrote to memory of 3600	4804	csrss.exe	93
PID 3600 wrote to memory of 2112	3600	csrss.exe	95
PID 3600 wrote to memory of 2112	3600	csrss.exe	95
PID 3600 wrote to memory of 2112	3600	csrss.exe	95
PID 2112 wrote to memory of 912	2112	csrss.exe	97
PID 2112 wrote to memory of 912	2112	csrss.exe	97
PID 2112 wrote to memory of 912	2112	csrss.exe	97
PID 2112 wrote to memory of 4296	2112	csrss.exe	99
PID 2112 wrote to memory of 4296	2112	csrss.exe	99
PID 2112 wrote to memory of 4296	2112	csrss.exe	99
PID 3600 wrote to memory of 232	3600	Process not Found	213
PID 3600 wrote to memory of 232	3600	Process not Found	213
PID 3600 wrote to memory of 232	3600	Process not Found	213
PID 232 wrote to memory of 1484	232	Conhost.exe	101
PID 232 wrote to memory of 1484	232	Conhost.exe	101
PID 232 wrote to memory of 1484	232	Conhost.exe	101
PID 1484 wrote to memory of 1000	1484	smss.exe	219
PID 1484 wrote to memory of 1000	1484	smss.exe	219
PID 1484 wrote to memory of 1000	1484	smss.exe	219
PID 1000 wrote to memory of 2560	1000	ping.exe	104
PID 1000 wrote to memory of 2560	1000	ping.exe	104
PID 1000 wrote to memory of 2560	1000	ping.exe	104
PID 1484 wrote to memory of 4840	1484	smss.exe	105
PID 1484 wrote to memory of 4840	1484	smss.exe	105
PID 1484 wrote to memory of 4840	1484	smss.exe	105
PID 4840 wrote to memory of 4700	4840	smss.exe	106
PID 4840 wrote to memory of 4700	4840	smss.exe	106
PID 4840 wrote to memory of 4700	4840	smss.exe	106
PID 1484 wrote to memory of 400	1484	smss.exe	108
PID 1484 wrote to memory of 400	1484	smss.exe	108
PID 1484 wrote to memory of 400	1484	smss.exe	108
PID 400 wrote to memory of 3768	400	lsass.exe	107
PID 400 wrote to memory of 3768	400	lsass.exe	107
PID 400 wrote to memory of 3768	400	lsass.exe	107
PID 3768 wrote to memory of 3680	3768	lsass.exe	109
PID 3768 wrote to memory of 3680	3768	lsass.exe	109
PID 3768 wrote to memory of 3680	3768	lsass.exe	109
PID 3680 wrote to memory of 2256	3680	csrss.exe	110
PID 3680 wrote to memory of 2256	3680	csrss.exe	110
PID 3680 wrote to memory of 2256	3680	csrss.exe	110
PID 3768 wrote to memory of 3016	3768	lsass.exe	186
PID 3768 wrote to memory of 3016	3768	lsass.exe	186
PID 3768 wrote to memory of 3016	3768	lsass.exe	186
PID 3016 wrote to memory of 2352	3016	smss.exe	181
PID 3016 wrote to memory of 2352	3016	smss.exe	181
PID 3016 wrote to memory of 2352	3016	smss.exe	181
PID 3768 wrote to memory of 2916	3768	lsass.exe	180
PID 3768 wrote to memory of 2916	3768	lsass.exe	180
PID 3768 wrote to memory of 2916	3768	lsass.exe	180
PID 2916 wrote to memory of 1384	2916	lsass.exe	117
PID 2916 wrote to memory of 1384	2916	lsass.exe	117
PID 2916 wrote to memory of 1384	2916	lsass.exe	117
PID 3768 wrote to memory of 3608	3768	lsass.exe	183
PID 3768 wrote to memory of 3608	3768	lsass.exe	183
PID 3768 wrote to memory of 3608	3768	lsass.exe	183
PID 3608 wrote to memory of 3444	3608	csrss.exe	111

System policy modification 1 TTPs 16 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	1008510c01ae812ac9411c6f1abca788.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	services.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1008510c01ae812ac9411c6f1abca788.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\1008510c01ae812ac9411c6f1abca788.exe
"C:\Users\Admin\AppData\Local\Temp\1008510c01ae812ac9411c6f1abca788.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\1008510c01ae812ac9411c6f1abca788.exe
  C:\Users\Admin\AppData\Local\Temp\1008510c01ae812ac9411c6f1abca788.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1856
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3600
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Modifies system executable filetype association
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2112
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:912
      - \??\c:\Documents and Settings\Admin\Application Data\Microsoft\amaa.exe
        
        "c:\Documents and Settings\Admin\Application Data\Microsoft\amaa.exe" csrss
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Modifies system executable filetype association
        Adds Run key to start application
        Enumerates connected drives
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4296
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        5⤵
        
        PID:232
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2404
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        6⤵
        
        PID:4488
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        5⤵
        
        PID:3244
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        6⤵
        Drops file in System32 directory
        
        PID:4516
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        7⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        7⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        8⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        9⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        10⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        9⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        10⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        9⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        10⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        9⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        10⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        9⤵
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        10⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        9⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:4920
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        9⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        9⤵
        Runs ping.exe
        
        PID:6036
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        9⤵
        Runs ping.exe
        
        PID:2088
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        7⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        7⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        8⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        9⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        10⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        9⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        10⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        11⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        12⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        11⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        12⤵
        
        PID:468
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        11⤵
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        12⤵
        
        PID:520
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        13⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        14⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        15⤵
        
        PID:468
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        13⤵
        Drops file in System32 directory
        
        PID:5876
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        13⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        14⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        13⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        14⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        13⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        14⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        13⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        13⤵
        Suspicious use of FindShellTrayWindow
        
        PID:2316
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        13⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        13⤵
        Runs ping.exe
        
        PID:5852
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        13⤵
        Runs ping.exe
        
        PID:808
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        13⤵
        Drops file in System32 directory
        
        PID:3244
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        11⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        11⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        12⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        11⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        11⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        11⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        11⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        11⤵
        Runs ping.exe
        
        PID:6376
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        9⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        9⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        10⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        9⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        10⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        9⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        9⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        9⤵
        Runs ping.exe
        
        PID:7084
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        9⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        9⤵
        Runs ping.exe
        
        PID:4848
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        7⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        7⤵
        
        PID:756
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        7⤵
        Runs ping.exe
        
        PID:5440
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        7⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        7⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Sets file execution options in registry
        Modifies system executable filetype association
        Adds Run key to start application
        Drops file in System32 directory
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:520
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        5⤵
        
        PID:6072
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        6⤵
        
        PID:6012
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        5⤵
        
        PID:6208
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        5⤵
        
        PID:6260
    - - C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        5⤵
        Runs ping.exe
        
        PID:6364
    - - C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        5⤵
        Runs ping.exe
        
        PID:6356
    - - C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        5⤵
        Runs ping.exe
        
        PID:6344
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:2968
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
      4⤵
      PID:3780
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4396
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3416
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4876
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2820
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:544
- - C:\Windows\SysWOW64\ping.exe
    ping www.rasasayang.com.my -n 65500 -l 1340
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\ping.exe
    ping www.data0.net -n 65500 -l 1340
    3⤵
    - Runs ping.exe
    PID:5044
- - C:\Windows\SysWOW64\ping.exe
    ping www.duniasex.com -n 65500 -l 1340
    3⤵
    - Runs ping.exe
    PID:4124
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1580

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1484
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
  2⤵
  PID:1000
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2560
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4700
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:400
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
  2⤵
  PID:5184
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    3⤵
    PID:5268
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  2⤵
  PID:5432
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Sets file execution options in registry
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - System policy modification
    PID:5588
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
      4⤵
      PID:5668
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        5⤵
        
        PID:5744
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
      4⤵
      PID:5852
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        5⤵
        
        PID:5908
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
      4⤵
      PID:5968
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        5⤵
        
        PID:6012
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
      4⤵
      PID:6076
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        5⤵
        
        PID:6108
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      4⤵
      PID:2088
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        5⤵
        
        PID:5264
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      4⤵
      PID:5232
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:5568
  - - C:\Windows\SysWOW64\ping.exe
      ping www.rasasayang.com.my -n 65500 -l 1340
      4⤵
      PID:5844
  - - C:\Windows\SysWOW64\ping.exe
      ping www.data0.net -n 65500 -l 1340
      4⤵
      PID:5788
  - - C:\Windows\SysWOW64\ping.exe
      ping www.duniasex.com -n 65500 -l 1340
      4⤵
      PID:5816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:5880
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  2⤵
  PID:5424
- C:\Windows\SysWOW64\ping.exe
  ping www.rasasayang.com.my -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:5968
- C:\Windows\SysWOW64\ping.exe
  ping www.data0.net -n 65500 -l 1340
  2⤵
  PID:5972
- C:\Windows\SysWOW64\ping.exe
  ping www.duniasex.com -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:6092

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3768
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2256
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
  2⤵
  PID:3608
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3780
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  2⤵
  PID:4920
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3016
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  2⤵
  - Drops file in System32 directory
  PID:3944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:5256
- C:\Windows\SysWOW64\ping.exe
  ping www.rasasayang.com.my -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:5460
- C:\Windows\SysWOW64\ping.exe
  ping www.data0.net -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:5452
- C:\Windows\SysWOW64\ping.exe
  ping www.duniasex.com -n 65500 -l 1340
  2⤵
  PID:5444

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3444
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3620
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4344
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:4456
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3668
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4052
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3012
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:2844
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    3⤵
    PID:3328
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      4⤵
      PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2068
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3952
- C:\Windows\SysWOW64\ping.exe
  ping www.rasasayang.com.my -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:4924
- C:\Windows\SysWOW64\ping.exe
  ping www.data0.net -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:4620
- C:\Windows\SysWOW64\ping.exe
  ping www.duniasex.com -n 65500 -l 1340
  2⤵
  PID:3024
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5080

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1384

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
1⤵
PID:1000
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4072
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4656
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:4016
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:524
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
    3⤵
    PID:652
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:1588
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:4112
- C:\Windows\SysWOW64\ping.exe
  ping www.rasasayang.com.my -n 65500 -l 1340
  2⤵
  PID:1064
- C:\Windows\SysWOW64\ping.exe
  ping www.data0.net -n 65500 -l 1340
  2⤵
  PID:1148
- C:\Windows\SysWOW64\ping.exe
  ping www.duniasex.com -n 65500 -l 1340
  2⤵
  PID:4452
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4596

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4056

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4968

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:652
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    3⤵
    PID:2688
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4028
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:868
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
  2⤵
  PID:2404
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:684
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:5076
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3608
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
      4⤵
      Loads dropped DLL
      PID:2620
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
      4⤵
      PID:3504
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        5⤵
        
        PID:1296
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
      4⤵
      PID:4220
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        5⤵
        
        PID:5056
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      4⤵
      Drops file in System32 directory
      PID:3524
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        5⤵
        
        PID:4388
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      4⤵
      PID:4516
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        5⤵
        
        PID:5176
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        6⤵
        
        PID:5316
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2400
  - - C:\Windows\SysWOW64\ping.exe
      ping www.rasasayang.com.my -n 65500 -l 1340
      4⤵
      PID:5024
  - - C:\Windows\SysWOW64\ping.exe
      ping www.data0.net -n 65500 -l 1340
      4⤵
      Runs ping.exe
      PID:4604
  - - C:\Windows\SysWOW64\ping.exe
      ping www.duniasex.com -n 65500 -l 1340
      4⤵
      Runs ping.exe
      PID:32
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  2⤵
  PID:3944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:4036
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3328
- C:\Windows\SysWOW64\ping.exe
  ping www.rasasayang.com.my -n 65500 -l 1340
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Runs ping.exe
  - Suspicious use of SetWindowsHookEx
  PID:2688
- C:\Windows\SysWOW64\ping.exe
  ping www.data0.net -n 65500 -l 1340
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Runs ping.exe
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1000
- C:\Windows\SysWOW64\ping.exe
  ping www.duniasex.com -n 65500 -l 1340
  2⤵
  PID:4064

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2824

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4324

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2352

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
1⤵
PID:4604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4388

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2384

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:232

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
1⤵
PID:5636

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5668

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
1⤵
PID:5716

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
1⤵
PID:3596

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5656

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
1⤵
PID:6588
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
  2⤵
  PID:6656
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    3⤵
    PID:6704
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
      4⤵
      PID:6792
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        5⤵
        
        PID:6860
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
      4⤵
      PID:6896
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        5⤵
        
        PID:6924
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        6⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        7⤵
        
        PID:6976
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        6⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        7⤵
        
        PID:7044
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        6⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        7⤵
        
        PID:7108
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        6⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        7⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        8⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        9⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        8⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        9⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        8⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        9⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        8⤵
        
        PID:408
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        9⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        8⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        9⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        8⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        8⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        8⤵
        Runs ping.exe
        
        PID:7184
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        8⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        8⤵
        
        PID:3000
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        6⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        7⤵
        
        PID:7304
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        6⤵
        
        PID:7424
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        6⤵
        
        PID:7572
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        6⤵
        
        PID:7704
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        6⤵
        
        PID:7696
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        6⤵
        
        PID:7688
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
      4⤵
      PID:7120
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        5⤵
        
        PID:5192
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
      4⤵
      PID:7096
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        5⤵
        
        PID:6732
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      4⤵
      PID:7004
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        5⤵
        
        PID:3000
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      4⤵
      PID:3152
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
      4⤵
      PID:7040
  - - C:\Windows\SysWOW64\ping.exe
      ping www.rasasayang.com.my -n 65500 -l 1340
      4⤵
      Runs ping.exe
      PID:1304
  - - C:\Windows\SysWOW64\ping.exe
      ping www.data0.net -n 65500 -l 1340
      4⤵
      Drops file in System32 directory
      PID:2104
  - - C:\Windows\SysWOW64\ping.exe
      ping www.duniasex.com -n 65500 -l 1340
      4⤵
      PID:6140
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
  2⤵
  PID:7036
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    3⤵
    PID:7088
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
    3⤵
    PID:6736
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
  2⤵
  PID:6896
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    3⤵
    PID:5068
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  2⤵
  PID:7000
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    3⤵
    PID:1044
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
      4⤵
      PID:6920
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        5⤵
        
        PID:2724
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        6⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        7⤵
        
        PID:6576
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        6⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        7⤵
        
        PID:7284
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        6⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        7⤵
        
        PID:7524
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        6⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        7⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        8⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        9⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        10⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        11⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        10⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        11⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        10⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        10⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        10⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        11⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        10⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        10⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:7736
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        10⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:7656
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        8⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        9⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        8⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        9⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        8⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        9⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        8⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        8⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        8⤵
        Runs ping.exe
        
        PID:6992
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        8⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        8⤵
        
        PID:7464
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        6⤵
        
        PID:4740
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        6⤵
        
        PID:8032
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        6⤵
        
        PID:8104
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        6⤵
        Runs ping.exe
        
        PID:5192
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        6⤵
        
        PID:8056
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        6⤵
        Runs ping.exe
        
        PID:8172
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
      4⤵
      PID:8180
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        5⤵
        
        PID:7388
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        6⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        7⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        8⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        9⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        8⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        9⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        8⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        9⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        10⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        11⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        10⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        11⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        10⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        11⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        10⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        11⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        12⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        13⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        12⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        13⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        12⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        13⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        12⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        13⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        12⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        13⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        12⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        12⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        12⤵
        Runs ping.exe
        
        PID:9144
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        12⤵
        Runs ping.exe
        
        PID:9136
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        12⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        10⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        10⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        10⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:8524
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:8600
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        10⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        8⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        9⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        10⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        11⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        10⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        11⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        10⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        11⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        12⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        13⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        12⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        13⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        12⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        13⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        12⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        13⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        12⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        13⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        12⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        12⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        12⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        12⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        12⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        10⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        10⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        11⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        12⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        13⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        12⤵
        
        PID:60
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        13⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        14⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        15⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        14⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        15⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        14⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        15⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        16⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        17⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        16⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        17⤵
        
        PID:932
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        16⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        17⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        16⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        17⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        16⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        17⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        16⤵
        
        PID:556
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        16⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        16⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        16⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        16⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        14⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        14⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        15⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        14⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        14⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        14⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        14⤵
        Runs ping.exe
        
        PID:10084
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        14⤵
        Runs ping.exe
        
        PID:9948
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        12⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        13⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        14⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        15⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        14⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        15⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        14⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        15⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        14⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        15⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        14⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        15⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        14⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        14⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        14⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        14⤵
        Runs ping.exe
        
        PID:10124
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        14⤵
        Runs ping.exe
        
        PID:10116
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        12⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        13⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        12⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        13⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        12⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        12⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        12⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        12⤵
        Runs ping.exe
        
        PID:9776
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        12⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        10⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        10⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:3464
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:3756
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:3952
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        8⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        9⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        8⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        8⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        8⤵
        Runs ping.exe
        
        PID:1544
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        8⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        8⤵
        
        PID:8180
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        6⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        7⤵
        
        PID:6168
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        6⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        7⤵
        
        PID:8992
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        6⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        7⤵
        
        PID:7300
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        6⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        7⤵
        
        PID:8284
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        6⤵
        
        PID:60
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        6⤵
        
        PID:9068
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        6⤵
        Runs ping.exe
        
        PID:9112
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        6⤵
        Runs ping.exe
        
        PID:8188
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        6⤵
        
        PID:8196
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
      4⤵
      PID:9168
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        5⤵
        
        PID:8608
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
      4⤵
      PID:9128
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        5⤵
        
        PID:8576
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      4⤵
      PID:8800
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        5⤵
        
        PID:6420
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      4⤵
      PID:8996
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\ping.exe
      ping www.rasasayang.com.my -n 65500 -l 1340
      4⤵
      Runs ping.exe
      PID:1664
  - - C:\Windows\SysWOW64\ping.exe
      ping www.data0.net -n 65500 -l 1340
      4⤵
      Runs ping.exe
      PID:8752
  - - C:\Windows\SysWOW64\ping.exe
      ping www.duniasex.com -n 65500 -l 1340
      4⤵
      PID:8356
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  2⤵
  PID:7812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
  2⤵
  PID:4464
- C:\Windows\SysWOW64\ping.exe
  ping www.rasasayang.com.my -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:7212
- C:\Windows\SysWOW64\ping.exe
  ping www.data0.net -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:7944
- C:\Windows\SysWOW64\ping.exe
  ping www.duniasex.com -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:6920

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
1⤵
PID:7796
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
  2⤵
  PID:7852

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
1⤵
PID:8168

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
1⤵
PID:7244

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:548

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
1⤵
PID:7644

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
1⤵
PID:8232

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
1⤵
PID:8632

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
1⤵
PID:3568
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
  2⤵
  PID:9288
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
    3⤵
    PID:9336
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
      4⤵
      PID:9400
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        5⤵
        
        PID:9440
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
      4⤵
      PID:9524
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        5⤵
        
        PID:9612
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
      4⤵
      PID:9672
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        5⤵
        
        PID:9744
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
      4⤵
      PID:9812
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        5⤵
        
        PID:9868
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      4⤵
      PID:9948
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        5⤵
        
        PID:9996
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      4⤵
      PID:10048
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
      4⤵
      PID:10220
  - - C:\Windows\SysWOW64\ping.exe
      ping www.rasasayang.com.my -n 65500 -l 1340
      4⤵
      Runs ping.exe
      PID:9468
  - - C:\Windows\SysWOW64\ping.exe
      ping www.data0.net -n 65500 -l 1340
      4⤵
      Runs ping.exe
      PID:9320
  - - C:\Windows\SysWOW64\ping.exe
      ping www.duniasex.com -n 65500 -l 1340
      4⤵
      PID:9420
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
  2⤵
  PID:9328
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
    3⤵
    PID:3964
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
  2⤵
  PID:6044
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
    3⤵
    PID:9620
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
      4⤵
      PID:9908
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        5⤵
        
        PID:4320
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Sets file execution options in registry
        Modifies system executable filetype association
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in System32 directory
        Modifies Internet Explorer settings
        Modifies registry class
        System policy modification
        
        PID:5820
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        7⤵
        
        PID:10000
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        6⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        7⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        8⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        9⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        8⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        9⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        8⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        9⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        8⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        9⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        8⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        9⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        10⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        11⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        11⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        10⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        11⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        10⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        11⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        10⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        11⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        10⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        11⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        10⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        10⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:2732
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:468
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:9944
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        11⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        8⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        8⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        8⤵
        Runs ping.exe
        
        PID:5228
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        8⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        8⤵
        Runs ping.exe
        
        PID:9996
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        6⤵
        
        PID:8516
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        6⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        7⤵
        
        PID:10468
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        6⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        7⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        8⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        9⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        8⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        9⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        8⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        9⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        8⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        9⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        10⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        11⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        10⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        11⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        10⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        11⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        10⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        11⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        10⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        11⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        10⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        10⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        10⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        10⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        10⤵
        Runs ping.exe
        
        PID:2196
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        8⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        9⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        8⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        8⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        8⤵
        Runs ping.exe
        
        PID:5484
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        8⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        8⤵
        
        PID:3892
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        6⤵
        
        PID:2652
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        6⤵
        
        PID:6892
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        6⤵
        Runs ping.exe
        
        PID:7628
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        6⤵
        Runs ping.exe
        
        PID:6700
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        6⤵
        
        PID:10820
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
      4⤵
      PID:10628
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        5⤵
        
        PID:10716
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        6⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        7⤵
        
        PID:10912
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
        6⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
        7⤵
        
        PID:11124
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
        6⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        7⤵
        
        PID:1488
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
        6⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        7⤵
        
        PID:6764
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        6⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        7⤵
        
        PID:9904
      - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
        6⤵
        
        PID:10948
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
        6⤵
        
        PID:7068
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.rasasayang.com.my -n 65500 -l 1340
        6⤵
        
        PID:10900
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.data0.net -n 65500 -l 1340
        6⤵
        
        PID:10696
      - C:\Windows\SysWOW64\ping.exe
        
        ping www.duniasex.com -n 65500 -l 1340
        6⤵
        
        PID:11052
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
      4⤵
      PID:10940
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
        5⤵
        
        PID:11216
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
      4⤵
      PID:10820
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
        5⤵
        
        PID:10596
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
      4⤵
      PID:4204
    - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        
        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        5⤵
        
        PID:2336
  - - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
      4⤵
      PID:7784
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
      4⤵
      PID:7860
  - - C:\Windows\SysWOW64\ping.exe
      ping www.rasasayang.com.my -n 65500 -l 1340
      4⤵
      PID:10656
  - - C:\Windows\SysWOW64\ping.exe
      ping www.data0.net -n 65500 -l 1340
      4⤵
      Runs ping.exe
      PID:10668
  - - C:\Windows\SysWOW64\ping.exe
      ping www.duniasex.com -n 65500 -l 1340
      4⤵
      PID:5144
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
  2⤵
  PID:10428
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
    3⤵
    PID:10500
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
  2⤵
  PID:10568
- - C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
    3⤵
    PID:10640
- C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
  2⤵
  PID:10808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
  2⤵
  PID:11064
- C:\Windows\SysWOW64\ping.exe
  ping www.rasasayang.com.my -n 65500 -l 1340
  2⤵
  PID:11188
- C:\Windows\SysWOW64\ping.exe
  ping www.data0.net -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:11180
- C:\Windows\SysWOW64\ping.exe
  ping www.duniasex.com -n 65500 -l 1340
  2⤵
  - Runs ping.exe
  PID:11172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1008510c01ae812ac9411c6f1abca788.exe

Filesize
50KB

MD5
69beac0954c38e170a6db8c50fe6a055

SHA1
2b16d43fa9c5d042a030b9267846cf254d47da75

SHA256
2f850319eb8dcefbd7d7c2f405c9b5a9e76ca7ebda34751017e2f23c01a00e8e

SHA512
c219d6d014898394116b1b19ac330143396af470198334f01b2944049b5bb9fe2c5febfcb040ff6ed2e75416908b7089ff0261b7c7c2029a60c3cae8a01666a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1008510c01ae812ac9411c6f1abca788.exe

Filesize
25KB

MD5
6bc9d4d163c2a340744e3737b072a145

SHA1
544d06e3a107d162099e4a2f42c2117d89ad4749

SHA256
71a139433c309fd7f439f88cef1b90090f82d3475edcb4e99eacd0d2d4163496

SHA512
c05c5596c5e618b8ddd7d61c0184039e8ac8f84045b3d9996d5b58b1be3424980add739cd23be27ae56c0306e4e45d68afecb545b0add9f5e8f7a7abc11e4646

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\amaa.exe

Filesize
76KB

MD5
21a4d4eafb50c4998a23ddd57ffcbbb6

SHA1
1f42d74af235f1ff1e04646b8201303e45e13963

SHA256
6d3a6c87ef5da70e015cc9638de7125ee2069359afef844b03f7234817774230

SHA512
2d7c33ce24fa546ba32ed0b5a2fca81a80e73949e0da0def7555eeacc59ecdd9a1b7334a7de748f35742c3c5dd83f1b3c4c47eb3175ca4731fbd5946e33fe9d0

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLL

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
127KB

MD5
94aef0f78b14f202883564fb36513f39

SHA1
c68991e96beecac55a222752bae44ef6797869f1

SHA256
9c448b1f4b58ac8022a9bf49cec1f8f97f9ca5f2a124799b770b7311f9c755df

SHA512
5cbb6255d6333b4a604ffa29d6ba6761d5732aa2bebf384587b06abfaae9826d890be56ee23ab1c4d0a09831aeef5d758267712af2cd3d72803c62e50534360d

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
1KB

MD5
7cfbccf7885ba430f3cd72d8fecc54df

SHA1
a35372bc7abe25930dd24b3795b76d2bbed30478

SHA256
f422543585c9ffb1a83e73d0c2055920b399e67fba157cda133b2dcee766bf10

SHA512
daab46af05c3ced4708cae77880384892752d32912360b937e7737f8a166528b235408fee1947399be600cf30c2c049d4cccb23a2e32e907d638c3a88fadff40

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe

Filesize
96KB

MD5
ac6f81c485d66fffcfd431464e9d8a04

SHA1
3c94dbd78d002ae5f03cac355645f87288eeb2bf

SHA256
85d0b275aa0552b1fb9b484c07b40e2fde66b04e3d542f58fa8881faf06bc327

SHA512
4d8bc50dc7a8b9488699032ef970a20159fcf7f5dc34c0ff18dabf60bac243fcd62a128755e2d58415371c9e73ad92c9250fa733f12ca4eae62d0ddca1562015

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe

Filesize
63KB

MD5
3dbe7e03a44a4256423d021cc6dc4b73

SHA1
c2e47489be19a589c2381b070dabf161795b77ae

SHA256
a496dd35e4e6a07c39453f46c1a258b7a27c1790b330fe53be7d98b7d230957d

SHA512
963c20aafd0d9ba64f5ac42f1c4b060f498eefbc3c47670fb8cf22a11cdf81d23b7975882c11ed08996e0796fb19cc4d76dcb0e23ed5ee485c883015625810cc

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe

Filesize
88KB

MD5
8395ef79c19cc182f70e9ac484473469

SHA1
0e09ac13912b1c8bc4f24a3525422edfb92e4a00

SHA256
28384ba460c683ad12deb8d0a055bf96790c348138eb9862552a2059ff2fee17

SHA512
2f1487fa22f938e89d4d980ca65cffaeea335648729dd1d9920866bb7da293e070d49a17d7c87317d25608cc4d0c915e0692fa4065a51cef7fefb6368caaf97c

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe

Filesize
46KB

MD5
2ebf59c11c37fd6daae56050c7fde584

SHA1
57a64756a43b517251162b93ad93e99d5f874fd8

SHA256
bb4c62a910d066646f6e5b27aeb4e4b93232ec2047295a5d7cb5bf775395e236

SHA512
cb392debf47766e91ec2ee983ada57ee59e1aeaad48208290c1b63bd8533cf6c876c05f2825fb8bab121cb144fa94458307008b55250e78f09ac64604b27aad9

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
340KB

MD5
843d92f6eed26e83159d154554afcb29

SHA1
e6a286aca580de30423e9081c8f38410c68c7a09

SHA256
81a4a2f6adf2b652f8cc6fc1738b36e8e5f33d81be6ab0818b113e731ff6edd3

SHA512
cce38f7f356972b311f5c5a9604ebb3f565070085ca12517d9e255aaea5644a30494f4759491f41650730a954adaa50d1b167c427b03bd0cf6a4426a2f626933

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
222KB

MD5
9987fd57cebcc98fa4d5d0fa864c61b5

SHA1
07612be4bb01251d1d1221fcc00d125a3609beab

SHA256
8bdbddfaeb953081ac39e3bb834ca030de6fd0464ca2a9a72f4dbfc6214e1694

SHA512
4292b58054ec3b8c9b8f469259df491b40b35ca5d1da03710fc86352c7240cc131de299a072aac416c7a2084dc9a5910ffce4389809f3954d126b77893ecee66

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
237KB

MD5
a9ebff88846da2df9d86e10f29c5d789

SHA1
80171a381844af7fccb46e14ffcafe9a46c867fb

SHA256
6a33d2c76410584f7341efb40270ceba2f107a53ffe6b24020019fc904cc358e

SHA512
831fe5d4590ed44ed20cdc47e4d66ad2ea838a728794ebcf08877b27faea6adcdc5ebff6f4e54cf6c70e444b8661578e0319f32f35c8b72bdff2a4c0aa3e527e

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
164KB

MD5
d17fae87f035f4477a76615cce8bcce3

SHA1
acd75f365b097de3993c04349bf19c397743f1db

SHA256
bdf15744c1d5bea3d3f948358d0c31ba86faef4a46caec08b23cde709f21cf53

SHA512
01f75c5fd308d94e258d2f1d7045a25ad0ff07152dda28773d4c0991e1057b4c23f802a6086fca07a3ce9c162f31e5e0cba8d28fbe5dd4040258193bf653acd7

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
207KB

MD5
016f2c94e9563b7094b5977dab41bf35

SHA1
9a1d1f7fdc397284f44642d39409daa83bfe507a

SHA256
7ace607d034186aff4d0fb19df4957a59bc555131f9a0592b669d0aa89460da3

SHA512
570a49a102aa72b1c8f741f8b05269e510ecab4d14d823f4f5e50197cf5599e75d448d8357e1e72530f0dc287e620076116861d05cafcf59a2c047058a5f99bd

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
224KB

MD5
b3bca4dceeea0343bd78424f9860d6f9

SHA1
4496b5d5667a5abb116f30c96fcd2b02d6fb00b7

SHA256
7f847d88a6690009b4b723aa3e45c3f5174fc29d81cd72e38e2bfd8e0dbdd3e7

SHA512
4da85d649d9777f6dd90edf1bc97c31c36895dabf2ba8edcd884237292416192947e0763467bd1abe3985cd2cf6e04be69f618880473d2cd0d6a1d0c09339b00

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
103KB

MD5
6cb8dc39a95b2b19fca5450efc1371e0

SHA1
4c489846c67f342f9ad6700586496ea183357f07

SHA256
29a7e68c5c6d9b353f8442fc0bd424e540d05a1b521239f27759d85e66b13291

SHA512
2a9bd478eef8b93d2b2136e1cbf32468ca0aabb4e2439d016c9fb6a55eae603e8cbecd83f7e1968ccf45f44bde66285280716b811118bee95444d76229b0c6f8

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
51KB

MD5
6c49a9d1c46ac157c9521b7ec542de25

SHA1
d6e85773bf608f18b77ff02e3684de28a6488542

SHA256
e3e0c2fe4d5c7d18d0a02dda6a44501d23907ff430a48efefedf4fbb89fba31f

SHA512
90232bda54cde2340fefbee6632ad55c2a8381ea2ee4987acd275d54d539eee0915e67e75e87df87831e757f05ed0d725de66572f929bd70d3a9366801f32f50

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
64KB

MD5
4c92980dcaed9b7879ad3ab51218bd86

SHA1
e35aa46abc5b3d5418d025f5987577922b5fe494

SHA256
250a875bca32c25db958fa3dc553e953899471d88507e0dd753e09101cc24196

SHA512
f2d864136d0402de1bf8c0a410ab82a6f29799d5e32325fde897e2cb5eb9d6671a78f8b1adf6c3ea24396634c488e69520279b81e558d39b10ea53db9e1af56e

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
211KB

MD5
47578a101c16e9e5edbfb263e5158a4e

SHA1
9551064b199e2c88ea0ad95d0309f0a665d8c767

SHA256
d0459c959f545ed9ed963470433aeb0810bcfab509fecfee987cc2a6726a0409

SHA512
73bdae0446c22aefbb478e1ac6909f45e4779709c07a3d52089f7b4683631f24700ffe4011706df8c36bf63a917c648aaaacc723f53b6a453dcad0329c1f6c42

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
141KB

MD5
f6ad4fe837ff8a37a936b4c93d684a4a

SHA1
bd70578e57679c1ef87beed93963d2fa4c56d629

SHA256
c13552189ab920fea6eb38da127c12e6f534f0f1cf44518f2ccd8b66bff6afb4

SHA512
56c14aa52f74e7d0cde323a87d7c501bc5134d3759de6e05af0c775bf57de9ab869fc8f954224c80aaf473d4d4691db4d3e120f27fbae931147d26b89ad1d9a6

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
94KB

MD5
af0401cb896590de271339fb8071bd04

SHA1
60fc6db2cce846f395249ae98e3695fe0510c8a1

SHA256
5a9553c56d550cd95e59d06c7d4ce6cc5066b2c939a55ecaed97fdf2eb8c0db9

SHA512
6e6bf6e699d1815fbe36069233c63e5f5418af81b6f72bd6b8b7482c27861fe56c3b6fa545e7653a4c989ff7a4c3c02da76652c4361de7419e4bd695322e2cc7

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
372KB

MD5
9fcc2b43dcca490d1991b94cec1f33bf

SHA1
df7242bd15f796d359451a199e9a2c4b21d866cd

SHA256
1f59a9eb9d89f3d3efc0f0cea6612b94b6fc10915a15b479f6846d942c938a46

SHA512
7a47b86e82e40cb84466041caf591191447d0ae88f54644598e10f3dc14634fd1ed7d2af8547fb797209742f0a7c6e80680178090431a2832427b82999b1e6ec

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
49KB

MD5
a6655e5b155908a74c382b9586f0cc4d

SHA1
540e9b0a6ec7fc9c0c761be450b0c1c759b269c6

SHA256
28feb0105499467f51dc93c57f2f6bb2f84a221a3c189ee4dab2a4f8e6b74adb

SHA512
e7ad2151e4d4617df79c806e0974294fefdf82a0c0b4b6eeeec616e972f23b05c1adb852b5306b36c4bc3a64c0f87e825a467a5f9731b551f25bb1094b6b6f5f

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
65KB

MD5
2ebc404eb8cde41bd77e7dc5dbd1271b

SHA1
35a28177f11b7ca09bde7ef74047f37a55fe73cd

SHA256
ab333408c7076038c6941b4e1d7ae7800c4f7ee695d20d45a66a30384700e6a7

SHA512
574f5a688289e7bd67053ff35c0c1534a807ae358ce7b790f6ee5bdcd1461783472a60bc0119fc0fc57cf7290bf9282f9f050b4dd0b39c87e51a3bd97136726b

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
57KB

MD5
ec45e07f2948f1183e594fd76394b4ec

SHA1
7523ca7003d6cc31998398464f8168f6ce1e6eed

SHA256
d22cbaeeeea4a872ee8e0f2feafd183c6758dea920a87a542bd98be69359587c

SHA512
29950dbbba367f7202a327afa3a7ec77ad4daf4ec8b71f7bb7f4e4f9dcf1966a883f0f519a3c62610d6f0e121e13a2801f77ff3baff433bdef467b912f05a505

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
149KB

MD5
7c00f16a19b22f3e699d37c71d428680

SHA1
b3c95402a4d63633688818f1c7602738ba0aa7ad

SHA256
443188b004fb7726107a4f2b6dcfb1543f7a9978066f26f38f7e2b4da701d387

SHA512
e94c319d7e7d16aec3bf626de1bd465732ff8ff850a4571a4b487ffa154a9e9666154697334d2b5b34a332c80086e873c2a52e171d7647e3e1e2520fad4d3787

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
192KB

MD5
93274507c605c6091ce315e0840c78ed

SHA1
89071bba9f5241391016ce749a76706c5370ae7a

SHA256
2d427b396a3dc52ea4a955f913a09fba7148e2c1043b67432852b5fb8c53a5f7

SHA512
4cdb44b26422518723b84d8c126c2c39d294335732fc498f8beaca22255c3d997cc9d827a65e9cd4af23ef622bec91e6a7f839ac6ed63a9a01050f76fa480d77

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\msvbvm60.dll

Filesize
175KB

MD5
303ef015ffc2e0dadc6cce29d1fc9bfb

SHA1
5c022420f8d8793186523f7aa48df5ba6139c81c

SHA256
03c5fa4a69b82ddfa0f550b9c927a0a0c7bb901c6ab1a11dad4e9b9f22450c66

SHA512
19ad63d7ed58fcc66351b3260aa26da13d85a95df4aa9de8ffc2258f6382259ce774b72ac39f706a8205a735c062e7ea502ead7397fcdc45a9993755af260fd3

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe

Filesize
25KB

MD5
bf2b0fbedc508e057ec60db46075bfc1

SHA1
2f07be8981be5adebd3a1705beea2171b4b56bc5

SHA256
61e7366a6f6c08bbffe4731f1a0f6b1ffac99f2643b75651081a26e555fce618

SHA512
d00267a6259a9051bbc04db791496aa36fb708d6eac0eb45f1ea1ec9cd2cf6076988c902f722b055d340d6b5353a4bb57d5c984963343f5d02d8864aaa075d68

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe

Filesize
127KB

MD5
31d06bda52c6c35d15dc1fdbacacb53e

SHA1
c74c87696c82b29d58f5c4562fbe95bfa7214e7d

SHA256
29cb88718da095455f4359e2fb2ee63f04db487ce62c6301500a8adb9227bff2

SHA512
503f142f3cae657e0956732c40a5b44176931d60fa46be5b8c2b6164f47a596263b424a3ea8cfdcf7cc5465551f16ac21b78aa076974d6896b8a882cda0e8cdc

Download Submit
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

Filesize
33KB

MD5
ca1eed2b1b686bed9b2d7559ed27a191

SHA1
57f0fcc243a560fb0bdae019940e452f1bddd6d2

SHA256
0a328ae071d7ad5e2a576c374e049fb55a2b34bfd9495bb50e19f15de7d7df63

SHA512
8eb8f042ca288981ccac3115005015bedf276c7983f2de11d357108e82cbc26e75cee63ea7b146b657313111b1544477b5585878e1680f75036a783969cf084e

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\amaa.exe

Filesize
76KB

MD5
6fdece7903a86e4dcac80a7fcb9e6a0a

SHA1
3c8f21884a083b7077d43bf446dbe1831534174d

SHA256
d094569075343794ce912add973cc462af1e477e036ef1764957c32540dfc8e4

SHA512
0cf3efc23ac232124db67bbc926cdcdfbaa3488e21d06e49f7886675f2629778158f46d8028d69c1ee92e2cec112e59e9a5023dc9ce6063422c873066579c83e

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
fd7e86b6ff65bc07e6253a67dc2e7c62

SHA1
fd6ffbdfbee144f3dccd882558c2bafb746a3ea5

SHA256
fb4a078ce2d5dc1dff02c5507c5e8efc62f682b29b7a5a24c985e4e52ad22ef4

SHA512
516a526f1a0afd85cbf38a097ff745a15fbf03b6ae74ad27fe2c46469187c505dc2bb410ab0887c3bfb747bc12918c16b8b542f7d4e6a7ff01b1cb010f35f085

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
memory/468-574-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/468-628-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/520-578-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/520-622-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/524-295-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/548-404-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/548-401-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/652-399-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/652-304-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/652-420-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/868-343-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/868-340-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/912-92-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/912-95-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1000-321-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1044-914-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1232-598-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1296-374-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1384-209-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1484-240-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1484-536-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1852-645-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1856-194-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1856-314-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1856-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2104-610-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2104-814-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2256-186-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2352-198-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2560-150-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2560-147-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2688-336-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2724-924-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2820-281-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2824-292-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3000-811-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3012-243-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3012-242-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3328-252-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3416-270-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3424-854-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3424-798-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3444-291-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3444-323-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3596-592-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3600-224-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3600-656-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3600-76-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3668-234-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3768-264-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3768-439-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3780-359-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3780-362-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3780-255-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4056-310-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4172-832-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4324-349-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4344-225-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4344-228-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4388-387-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4488-408-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4516-705-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4516-493-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4516-421-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4604-368-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4656-282-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4700-161-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4968-317-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4980-586-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5056-380-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5068-812-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5076-393-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5192-756-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5232-614-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5268-436-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5316-437-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5348-508-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5492-519-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5588-528-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5588-524-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5636-455-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5656-568-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5716-544-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5732-527-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5744-461-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5760-557-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5820-538-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5852-605-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5908-475-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5916-470-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5916-476-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5916-637-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5916-657-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6012-644-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6012-485-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6052-494-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6108-496-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6576-847-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6588-725-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6596-775-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6652-720-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6704-731-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6732-784-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6736-777-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6792-739-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6924-747-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6924-883-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6976-687-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6976-683-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6984-741-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7008-810-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7044-695-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7088-755-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7108-709-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7284-864-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7304-862-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7524-875-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7852-890-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/8040-902-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/8104-909-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/8168-918-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download