Analysis

  • max time kernel
    149s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 03:52

General

  • Target

    d82cefe294d40ccf445218475806acc484245716c4ddaff04facc27fa0c2e28c.exe

  • Size

    70KB

  • MD5

    2fd685a44814d363e81a07de7bee5233

  • SHA1

    a9170c0738cf9f0d746ff409907f13a93f0baf04

  • SHA256

    d82cefe294d40ccf445218475806acc484245716c4ddaff04facc27fa0c2e28c

  • SHA512

    5bfddc19d55b0377410e1681de30336956f9f9f59b26f8237863079b7b0df0d05aec773ea5e3045dba3b5bed4109b536c75a171d356494285a8a5dd498c87bf5

  • SSDEEP

    768:1iCHI1nffAkGisSQ6KRcJZOYoBudWaDyqzlL49FLdS5yA+jz+CEo+R5nOwekfZUW:1LHIlfH7Q6qRBwWa2qxQFZA+j6/Ww+9

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 18 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 9 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 9 IoCs
  • Windows security bypass 2 TTPs 27 IoCs
  • Disables RegEdit via registry modification 18 IoCs
  • Disables Task Manager via registry modification
  • Disables use of System Restore points 1 TTPs
  • Executes dropped EXE 56 IoCs
  • Loads dropped DLL 7 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
  • Windows security modification 2 TTPs 36 IoCs
  • Adds Run key to start application 2 TTPs 45 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 8 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 50 IoCs
  • Drops file in Windows directory 45 IoCs
  • Modifies Control Panel 54 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 57 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d82cefe294d40ccf445218475806acc484245716c4ddaff04facc27fa0c2e28c.exe
    "C:\Users\Admin\AppData\Local\Temp\d82cefe294d40ccf445218475806acc484245716c4ddaff04facc27fa0c2e28c.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Modifies system executable filetype association
    • Windows security modification
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1508
    • C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1452
    • C:\WINDOWS\SysWOW64\cmd.exe
      C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
      2⤵
        PID:2616
      • C:\WINDOWS\SysWOW64\cmd.exe
        C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
        2⤵
          PID:1336
        • C:\WINDOWS\SysWOW64\cmd.exe
          C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
          2⤵
            PID:732
          • C:\WINDOWS\SysWOW64\cmd.exe
            C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
            2⤵
              PID:5040
            • C:\WINDOWS\SysWOW64\cmd.exe
              C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
              2⤵
                PID:2916
              • C:\WINDOWS\SysWOW64\cmd.exe
                C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                2⤵
                  PID:3048
                • C:\WINDOWS\SysWOW64\cmd.exe
                  C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                  2⤵
                    PID:2472
                  • C:\WINDOWS\SysWOW64\cmd.exe
                    C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                    2⤵
                      PID:3228
                    • C:\WINDOWS\SysWOW64\cmd.exe
                      C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                      2⤵
                        PID:5000
                      • C:\WINDOWS\SysWOW64\cmd.exe
                        C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                        2⤵
                          PID:2452
                        • C:\WINDOWS\SysWOW64\cmd.exe
                          C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                          2⤵
                            PID:3180
                          • C:\WINDOWS\SysWOW64\cmd.exe
                            C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                            2⤵
                              PID:4256
                            • C:\WINDOWS\SysWOW64\cmd.exe
                              C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                              2⤵
                                PID:4348
                              • C:\WINDOWS\SysWOW64\cmd.exe
                                C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                2⤵
                                  PID:4252
                                • C:\WINDOWS\SysWOW64\cmd.exe
                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                  2⤵
                                    PID:3756
                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                    2⤵
                                      PID:4360
                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                      2⤵
                                        PID:4772
                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                        2⤵
                                          PID:4840
                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                          2⤵
                                            PID:4064
                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                            2⤵
                                              PID:4368
                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                              2⤵
                                                PID:1192
                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                2⤵
                                                  PID:2180
                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                  2⤵
                                                    PID:1032
                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                    2⤵
                                                      PID:3408
                                                    • C:\Windows\Black Hole.exe
                                                      "C:\Windows\Black Hole.exe"
                                                      2⤵
                                                      • Modifies WinLogon for persistence
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies visiblity of hidden/system files in Explorer
                                                      • Windows security bypass
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Modifies system executable filetype association
                                                      • Windows security modification
                                                      • Adds Run key to start application
                                                      • Modifies Control Panel
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:2584
                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                        3⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4892
                                                    • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                      "C:\Windows\system32\Lubang Hitam.exe"
                                                      2⤵
                                                      • Modifies WinLogon for persistence
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies visiblity of hidden/system files in Explorer
                                                      • Windows security bypass
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Modifies system executable filetype association
                                                      • Windows security modification
                                                      • Adds Run key to start application
                                                      • Enumerates connected drives
                                                      • Drops autorun.inf file
                                                      • Drops file in System32 directory
                                                      • Drops file in Windows directory
                                                      • Modifies Control Panel
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:4040
                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                        3⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1036
                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                        3⤵
                                                          PID:1960
                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                          3⤵
                                                            PID:4316
                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                            3⤵
                                                              PID:4324
                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                              3⤵
                                                                PID:4636
                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                3⤵
                                                                  PID:3748
                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                  3⤵
                                                                    PID:4292
                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                    3⤵
                                                                      PID:2340
                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                      3⤵
                                                                        PID:2612
                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                        3⤵
                                                                          PID:776
                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                          3⤵
                                                                            PID:4208
                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                            3⤵
                                                                              PID:1796
                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                              3⤵
                                                                                PID:2556
                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                3⤵
                                                                                  PID:1452
                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                  3⤵
                                                                                    PID:3324
                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                    3⤵
                                                                                      PID:3016
                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                      3⤵
                                                                                        PID:728
                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                        3⤵
                                                                                          PID:1832
                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                          3⤵
                                                                                            PID:3448
                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                            3⤵
                                                                                              PID:1580
                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                              3⤵
                                                                                                PID:428
                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                3⤵
                                                                                                  PID:564
                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                  3⤵
                                                                                                    PID:1956
                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                    3⤵
                                                                                                      PID:2168
                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                      3⤵
                                                                                                        PID:3928
                                                                                                      • C:\Windows\Black Hole.exe
                                                                                                        "C:\Windows\Black Hole.exe"
                                                                                                        3⤵
                                                                                                        • Modifies WinLogon for persistence
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                        • Windows security bypass
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Modifies system executable filetype association
                                                                                                        • Windows security modification
                                                                                                        • Adds Run key to start application
                                                                                                        • Enumerates connected drives
                                                                                                        • Drops file in System32 directory
                                                                                                        • Drops file in Windows directory
                                                                                                        • Modifies Control Panel
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        • System policy modification
                                                                                                        PID:4692
                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                          4⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:1840
                                                                                                        • C:\Windows\Black Hole.exe
                                                                                                          "C:\Windows\Black Hole.exe"
                                                                                                          4⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:1820
                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                            5⤵
                                                                                                              PID:3500
                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                6⤵
                                                                                                                  PID:3600
                                                                                                            • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                              "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in System32 directory
                                                                                                              • Drops file in Windows directory
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:2452
                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                5⤵
                                                                                                                  PID:2788
                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:116
                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                  5⤵
                                                                                                                    PID:944
                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:320
                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                    5⤵
                                                                                                                      PID:3904
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        6⤵
                                                                                                                          PID:2340
                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                      4⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:4800
                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                        5⤵
                                                                                                                          PID:4476
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            6⤵
                                                                                                                              PID:940
                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                          4⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:1464
                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                            5⤵
                                                                                                                              PID:2268
                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                            4⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:4328
                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                              5⤵
                                                                                                                                PID:724
                                                                                                                          • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                            "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:4768
                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                              4⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1580
                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:4840
                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                              4⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1084
                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:2156
                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                              4⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:4752
                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:4572
                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                              4⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:928
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                5⤵
                                                                                                                                  PID:2352
                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:1400
                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                4⤵
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4772
                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:1732
                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                4⤵
                                                                                                                                  PID:776
                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                              2⤵
                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                              • Windows security bypass
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Modifies system executable filetype association
                                                                                                                              • Windows security modification
                                                                                                                              • Adds Run key to start application
                                                                                                                              • Enumerates connected drives
                                                                                                                              • Drops autorun.inf file
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Modifies Control Panel
                                                                                                                              • Modifies registry class
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              • System policy modification
                                                                                                                              PID:3820
                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                3⤵
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:2352
                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                3⤵
                                                                                                                                  PID:1576
                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                  3⤵
                                                                                                                                    PID:4796
                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                    3⤵
                                                                                                                                      PID:1196
                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                      3⤵
                                                                                                                                        PID:4308
                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                        3⤵
                                                                                                                                          PID:396
                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                          3⤵
                                                                                                                                            PID:1952
                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                            3⤵
                                                                                                                                              PID:2448
                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                              3⤵
                                                                                                                                                PID:1400
                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                3⤵
                                                                                                                                                  PID:4084
                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2868
                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2856
                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4348
                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4908
                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4452
                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4880
                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2232
                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4712
                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4840
                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4924
                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2436
                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1772
                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4568
                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4440
                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4696
                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                "C:\Windows\Black Hole.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:1776
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1400
                                                                                                                                                                              • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:1952
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:3532
                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:2264
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:2340
                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:5096
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:5068
                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:3320
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:2200
                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:2180
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:3028
                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:940
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1020
                                                                                                                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                              • Windows security bypass
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                              • Windows security modification
                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • Modifies Control Panel
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              • System policy modification
                                                                                                                                                                              PID:816
                                                                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:3304
                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:776
                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4800
                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:4696
                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2556
                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2432
                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3740
                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4444
                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5040
                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:1832
                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4032
                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4004
                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3020
                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2356
                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5060
                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3936
                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5052
                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2680
                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4016
                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2352
                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5028
                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                                                  • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                    "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                    PID:2100
                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                    PID:4784
                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:2244
                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:3104
                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:1196
                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:4764
                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:1528
                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:3216
                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:652
                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                        PID:4080
                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                                                                        • Windows security modification
                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • Modifies Control Panel
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                        PID:3496
                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:2900
                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:4568
                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:564
                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1052
                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1576
                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:748
                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:3768
                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:3196
                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:4772
                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:5088
                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:1532
                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:1244
                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:532
                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:732
                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:3732
                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5036
                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3032
                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:4440
                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:4528
                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:4192
                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:228
                                                                                                                                                                                                                                                                                              • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                PID:2460
                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:4716
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:2092
                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:4064
                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                    PID:1396
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:4964
                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:4924
                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:3628
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:3440
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:2584
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                          PID:1852
                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:4208
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                          • Windows security bypass
                                                                                                                                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                          • Windows security modification
                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • Modifies Control Panel
                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                                          PID:2248
                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:440
                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:2460
                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:2472
                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:4328
                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:3756
                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:3644
                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:2100
                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:1400
                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:2856
                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:3928
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:1452
                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:3964
                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:2092
                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:3028
                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:4988
                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4116
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4444
                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4232
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2680
                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1952
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1796
                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3680
                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                      PID:1372
                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                        PID:3140
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3952
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                          PID:3600
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2028
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4460
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                            PID:2704
                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4876
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2684
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1120
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2264
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                    PID:2100
                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1576
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2432
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                        PID:3360
                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4752
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies system executable filetype association
                                                                                                                                                                                                                                                                                                                                                                                        • Windows security modification
                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies Control Panel
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                          PID:3740
                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q z:
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q y:
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1252
                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q x:
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4320
                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q w:
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q v:
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q u:
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q t:
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q s:
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q r:
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q q:
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q p:
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q o:
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q n:
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\cmd.exe /c rd /s /q m:
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q l:
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q k:
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\WINDOWS\system32\cmd.exe /c rd /s /q j:
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q i:
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\cmd.exe /c rd /s /q h:
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\WINDOWS\system32\cmd.exe /c rd /s /q g:
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:384
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\cmd.exe /c rd /s /q f:
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\cmd.exe /c rd /s /q e:
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\cmd.exe /c rd /s /q d:
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\cmd.exe /c rd /s /q c:
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Black Hole.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Black Hole.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3308

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Black Hole.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c2dad8cd19a2061f9cb152b36e261c80

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  50947e9db21f3e7b7efb9d3cd43738aa75e30eb1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f0dc94736036677e97071d44a5b954bc6c11f0ae13a00aa31ab854d8aa583845

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b8e264a77440d4d943dc5b493cb8e2364f457a83534f346381709e90d714df13170d410dbcb5c45a189491e858e7ec5f59f254814b4b2a3aeb36ea050c47067e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Black Hole.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52f13d5f1e062562a89ab6a7d20f45a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  faed88a0c1d882f80d46efab59db82657345d3e5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  66b3300b84802ab3446fc69350f66537b808bdec219ca025b1a6d6d6fc31bfcb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cc987626e6e066ddf113c3663a9e2f9aecc59eec452de996665c1358a289affd821872e4969763049b8847806978c6deaa0df0347ad0b86f1bfc0486d51879a7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5d8b71df1f0fc372df4d18c3b278cd72

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  03a0f3e60c9caaaab771c4e4e749b922dbdb5f98

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c14ac0df3eb141ee06ac985f944a446d2f5eb501ea8701b977617358262ae218

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b0be124d27aef723c8558c01255361ea4ddcdcd4c6299fb59420aba13aa16c4273ecb8c16b62830ec69215b1ecdf328537a2c4c214332336ad51921c9aca1dd9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0f04263db021b2e40d767ae8891f9ba7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e1dc312cdbecacfd1fba0ebfeca71231a238ace4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f12e676fa16a354d8495b6076c503361d16ac318f97c1e3362d352d63f5189e3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8648fd2146d6eef778415145d8c18cfad6ecb0c663cc7617d2179382c13b11b046a23f445b42dfb487c3cee5d2d58d21e19f57530fd1fafb2052df871014e12b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1435ec2300ca23bb8eb38a700c73e98c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  16f065576c78fd402ee18888c4c2038e212423bb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3d63c957c6bef0646842f6b52194a66844357a2ce898124a30373174a9e84bc0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4d85ddd2a2bd8b92f69053ebb5be3a867fe87a53b5eb7486501643be80c00a475c71aa42277b3e0f6ff71d74946c98f65fcfa8f7041c40fc8e47dea39d92e77e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277614c6e6f0f7b86381b5db63434e92

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2ffe34be1da219689cf710936a0962aafb3360e2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7caaec03349b42bf40edf3e08fefb5b422ad90bb63dd2fe80c339ffc9306d7c7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2ced2995b43f5c9f09b4ca9c978be0541f9cfd2124c25ffe7dd135d6b478a82091226ec62eefae0d0a8b891e7c7f25e08f892b4bfc5e608c0b6f15334759a470

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4857ebb09c526f3c9f73abda3a42e8a6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  37ba2a3bf091c5cf52e7d59c96b5a5def2b3cf12

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2e8f6e96191d494335f9115c7f45136928d2a15d28493b4dde9b4b39c82b3538

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  63cd432752b631c3e11b799aeec26d03d162c53448f2e15ce5a349f14fb4b2f365037bb080ab5aebbeb33e1c985000beec8207eab1bc5075cdd7a1c6733e2831

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  473012b1fafd77fd846773c4225de605

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e62849be31456f3193ca8d25d089aa8c0e9fafa7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5f5795a9d923a53106c91a1123f8e3efc7fd9a0884db3b85349d8e7d4a6f920

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d6543021e77377d9be48007b08f1c6985e1afae6cc897c334311d1bfd6a02d25f76ba0cf5795f66d715ad79f5e57dcbb046ce27b3382c2e2e639839b556592eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dee0b6b16ec7d37df16656b72bbf236e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  915ad1d16be9bceac4fe04b2b0a2dcc903dbd1f0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b2bb288750d807cc98bdd3c563e2b61d60b8a0255c0e7f949227fe403d525658

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1ea831a680247e4d17a18a3784f4f733d6d60fad435f335e487ad69a2194195ae16c381154256691cb3d30e5142899f08780552464c5b50cf29868ef92b5612f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\Black Hole.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6635e047c242e6d64b2716d81095bf5f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5def5300f894e58bbb0caaa94680f7735ccd248d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\WINDOWS\Hacked By Gerry.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e067dafcbe64a95f5045a281397732db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1af7095f98c486ca247449980000d06b04ffc50c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Black Hole.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  66a474002037e8cb85bb7ddcd6d1a88f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  782efd88c157ca3ed77c582731ecc75ca3787caa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  97ac843287e734bdbbb0d08730982b06847862f42fdada4a0497b6c79e4c75b9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  625d0017f69a8aaea9fe3088cb24b6c262907a3ecd0907fa50ed35b559c34ffb3a46dc382b02129c7647d0c2380dc053a14e7482f25ebf337397113ea604af9a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Black Hole.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3515c7ddd0cb41c66bf2b90b1dc5483c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cf1ff1a4f3bf932c9c979bd20f4dc67957e79cdf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ac2315458f18bdbb71251cc985e6849dcf8ed1b45c53571c1830a8941624bdc4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b960f460610a4349f9ad79b7ccf6194d9a187445e879d8edd2d69c6aeaaf68a65feb62ad314b7e602850a72726440207663e135911be9db6e53e52b27662fa60

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Black Hole.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  69d811e5f9265b2c3eccfc39c9597938

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56ad7a089a5e2031f157e4fca2d71310b02a230e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9dc6bdb598a14dd1434c2c6d47aa5e964ae80e7cee8a1bb4ddfac8c002a6c02e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  db01289226fbda920f5455d0e5c1afbfcc54685a82bfb3c64c147bee43e94a2fee83a105c995360f15844a43f56a173a8728df865cbb7a084b93e080fded5331

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Destruction.scr

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ecae673d3b7831716af86a8886654184

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1ce431abcd9a370211cb4c7912879d41a640705e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  698ac72e4438d65b979c880ec3d394c63f33e0206b7d6274091074aa04757ae2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0421da35f5dd4efe7473b7ced9cf061fe12b121eda52d2f03b158ac333905f12a469c6fb3cf7a9078b73c72a32876632143f2a2e2b15fbd1ac730357bbfb622e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Destruction.scr

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31cf1bc9357c8bfc496951f3c6b2f1d4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  46e43ddc6a17bcda9f43a1e37404e47dd0950c37

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  00c3cd6220170d19cc3d8502084d07bab79b68c6b11f36624d0bddf502522295

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5597b77c335c2e3e925285f7bc445f6f43b36010dc5fa12cc47824fc3d6ba1c8a64e4fd1ff6013ff783d2ce557c28ec7d0fd0e228c3fdba59d56dd87eb2658bf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Lubang Hitam.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6d93a9ba850363e4f3d27a1b9b53cae7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a02a8804d6e5d6b2640f4678603a3190ff9c5915

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3bdee662b5d0224f43ddcda09189658a76cc01662c9d0550ee499be55d2b9d51

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ac8544a3eac5ef361fee4e077a0531306c2c48f9dcc6ba739c02e6dbbfdf17e7f640b3cffd17a3329997228434ed583c898061bba219d67f4d02687399809cf2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Lubang Hitam.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2fd685a44814d363e81a07de7bee5233

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a9170c0738cf9f0d746ff409907f13a93f0baf04

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d82cefe294d40ccf445218475806acc484245716c4ddaff04facc27fa0c2e28c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5bfddc19d55b0377410e1681de30336956f9f9f59b26f8237863079b7b0df0d05aec773ea5e3045dba3b5bed4109b536c75a171d356494285a8a5dd498c87bf5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Shell.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  39bd810987ba65e42a955cb955d480bc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  45251b9d7da24ac60fd7e3ea2b3b7d902bcdee6e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  87b24d48f1f57173b3a0ad20886726049a213cbd030682b007450686409999a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  97c8dd1b9488e9ec28c1c32600156f7846187013e38694e1316dec3052c7eaa72b6499c27294478b2ed11570a171ca08bd61d71315029c8b1792c7bfb1bef6ce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Shell.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8b855b20db6eb57ba796a8e7501572f7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  42953ed73121b53c873019bbf071910b62065467

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fcd8fb6c69fdac330da0616413ee15676307716d28bcefc52832c3e6ec368ddc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c5966455eb6db3e0d2b194d8211bf4b9cccee9a47c49074958c80f6c467e1ff4bdbd3b867febb87b232e5fdb2cea450adb3f5ea7a46f11c1b92c507482ad28e4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\msvbvm60.dll

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  25f62c02619174b35851b0e0455b3d94

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4e8ee85157f1769f6e3f61c0acbe59072209da71

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • F:\Autorun.inf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4809daf962803cad2b891b94c195d3dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  707bdd28edcf5e9e288959f62d4da8823777ec12

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3468667630714eb86464ecfe903b59a843670ade55b49ac9d653421b91bcf139

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c9c233b22a853ce17731cb3466f7e8234da4e3de0dec6cc48ed15232303d4f29c49770e20a7064ad9329f8d9d27f8d4b547443d837320f58ac230973bb7dd11f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • F:\Black Hole.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a7337a8f176b77efa8a8fabb224e054c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2fb4ed8c63758f276963e82e73130be3c5613c26

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f63a282980928aabc7cc02edfde5bed1fa86b13a1365c000a61d44864dbdf604

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fff2fb8eef0c9ec05975345ad2ebc59038df004965813fe398c3f85159eb622d65557debe350378efee5c94af6c85aa7fd95ef96d2f8d902ac61a5e8abdc2c09

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • F:\Read Me.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5c462f1ea2917c0b502ae0761c0f60d8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c1d15b093b2843528544d77dc0d9d4e3b8a85297

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  09c76898e4fa4174c53c2ad514274b5d2ca636ec6f223be5fda4c6135ec4ac10

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e6219ccbabe77a4999ade79c7074753495da9c61d6451c53be34219cc19746ca9a0dadef3b47cd8859cd59604064af5e9fc2a5044780bcfebaaa13dc08c36bbc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/116-701-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/816-766-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/816-98-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/888-651-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/940-508-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1372-504-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1396-684-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1396-688-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1464-713-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1508-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1508-0-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1508-860-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1508-406-0x00000000001C0000-0x00000000001C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1776-403-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1776-409-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1820-686-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1952-534-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1952-413-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2060-699-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2060-691-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2092-493-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2100-444-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2156-459-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2180-476-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2248-131-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2248-814-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2264-417-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2264-419-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2452-695-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2460-475-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2584-86-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2584-66-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2920-645-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3016-671-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3044-643-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3044-637-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3104-473-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3104-460-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3320-458-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3360-656-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3496-788-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3496-114-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3820-743-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3820-89-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4032-510-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4040-78-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4040-723-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4064-494-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4080-620-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4152-520-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4424-621-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4424-633-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4632-837-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4692-282-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4692-859-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4740-581-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4768-432-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4780-655-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4784-445-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4784-457-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4800-709-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4800-707-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4840-437-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4840-447-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4924-588-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5096-430-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5096-442-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  432KB