Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2be1515a46...18.exe

windows7-x64

10

2be1515a46...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 05:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2be1515a460d1a1eed83739c8698af6d_JaffaCakes118.exe

  • Size

    127KB

  • MD5

    2be1515a460d1a1eed83739c8698af6d

  • SHA1

    97fb87c168633c4ecf4114884e71d7cb93171219

  • SHA256

    f30af26ea7a16488fb969a6e7d5003c055a6e0435997d6e0a75bab826fe92314

  • SHA512

    5844568e30b4a18c277f6fae52a1cce66d69846b4c9079fa52a995822111962c213453317a17158d4236e3b759c7ad2afc0f825e05f11880ce2d553c0f22e9c1

  • SSDEEP

    1536:lamlu3hbBGy3G8nhMpD7MUYU6U5jUdPQc+n35KZg8/nouy8Iu:lreMPd/MYjUtQl78vout

Score
10/10
discoveryevasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 11 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 13 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 11 IoCs
    evasion
  • UAC bypass 3 TTPs 11 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 11 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 13 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 56 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 11 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 33 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 58 IoCs
  • Runs ping.exe 1 TTPs 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 22 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2be1515a460d1a1eed83739c8698af6d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2be1515a460d1a1eed83739c8698af6d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Local\Temp\2be1515a460d1a1eed83739c8698af6d_JaffaCakes118.exe 
      C:\Users\Admin\AppData\Local\Temp\2be1515a460d1a1eed83739c8698af6d_JaffaCakes118.exe 
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4960
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4920
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2616
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3396
            • \??\c:\Documents and Settings\Admin\Application Data\Microsoft\dvcv.exe
              "c:\Documents and Settings\Admin\Application Data\Microsoft\dvcv.exe" csrss
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • Drops file in Program Files directory
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:1872
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5104
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Event Triggered Execution: Image File Execution Options Injection
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3744
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2364
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:2244
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3964
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1820
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:432
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                  8⤵
                  • Modifies WinLogon for persistence
                  • Modifies visibility of file extensions in Explorer
                  • Modifies visiblity of hidden/system files in Explorer
                  • UAC bypass
                  • Disables RegEdit via registry modification
                  • Event Triggered Execution: Image File Execution Options Injection
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Checks whether UAC is enabled
                  • Drops file in System32 directory
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:1852
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4072
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:2540
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:228
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3568
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4352
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4824
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:620
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                      10⤵
                      • Modifies WinLogon for persistence
                      • Modifies visibility of file extensions in Explorer
                      • Modifies visiblity of hidden/system files in Explorer
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Event Triggered Execution: Image File Execution Options Injection
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • Drops file in System32 directory
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:3960
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:5000
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:1736
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:912
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:2028
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Suspicious use of SetWindowsHookEx
                        PID:4600
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:4868
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:3524
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:4984
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:392
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                          12⤵
                          • Modifies WinLogon for persistence
                          • Modifies visibility of file extensions in Explorer
                          • Modifies visiblity of hidden/system files in Explorer
                          • UAC bypass
                          • Disables RegEdit via registry modification
                          • Event Triggered Execution: Image File Execution Options Injection
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:4344
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:3064
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetWindowsHookEx
                              PID:4888
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • Suspicious use of SetWindowsHookEx
                            PID:3504
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetWindowsHookEx
                              PID:4488
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:948
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetWindowsHookEx
                              PID:4860
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:3272
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetWindowsHookEx
                              PID:5072
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:760
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetWindowsHookEx
                              PID:1280
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:1796
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                            13⤵
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SetWindowsHookEx
                            PID:4924
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.duniasex.com -n 65500 -l 1340
                            13⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:3668
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.data0.net -n 65500 -l 1340
                            13⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:3012
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.rasasayang.com.my -n 65500 -l 1340
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:208
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:4664
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        PID:2564
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.duniasex.com -n 65500 -l 1340
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:344
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.data0.net -n 65500 -l 1340
                        11⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:3288
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.rasasayang.com.my -n 65500 -l 1340
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:4280
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:1540
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                      10⤵
                      • Modifies WinLogon for persistence
                      • Modifies visibility of file extensions in Explorer
                      • Modifies visiblity of hidden/system files in Explorer
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Event Triggered Execution: Image File Execution Options Injection
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:532
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:4020
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:3372
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:1692
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:1864
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:3168
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:4680
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:4896
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                          12⤵
                          • Modifies WinLogon for persistence
                          • Modifies visibility of file extensions in Explorer
                          • Modifies visiblity of hidden/system files in Explorer
                          • UAC bypass
                          • Disables RegEdit via registry modification
                          • Event Triggered Execution: Image File Execution Options Injection
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:4556
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:1172
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetWindowsHookEx
                              PID:4104
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:1396
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:1308
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:5032
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:2640
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            PID:5076
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:4000
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:3004
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:2056
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                            13⤵
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            PID:4936
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of FindShellTrayWindow
                            PID:2008
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.duniasex.com -n 65500 -l 1340
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:4300
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.data0.net -n 65500 -l 1340
                            13⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2416
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.rasasayang.com.my -n 65500 -l 1340
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:4388
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        11⤵
                        • Loads dropped DLL
                        PID:4260
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:536
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:2660
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        PID:4128
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.duniasex.com -n 65500 -l 1340
                        11⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1332
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.data0.net -n 65500 -l 1340
                        11⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:628
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.rasasayang.com.my -n 65500 -l 1340
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1836
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                    9⤵
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    PID:3440
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    PID:3940
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.duniasex.com -n 65500 -l 1340
                    9⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:1204
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.data0.net -n 65500 -l 1340
                    9⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:4104
                  • C:\Windows\SysWOW64\ping.exe
                    ping www.rasasayang.com.my -n 65500 -l 1340
                    9⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:1696
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      10⤵
                        PID:5032
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1736
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                    8⤵
                    • Modifies WinLogon for persistence
                    • Modifies visibility of file extensions in Explorer
                    • Modifies visiblity of hidden/system files in Explorer
                    • UAC bypass
                    • Disables RegEdit via registry modification
                    • Event Triggered Execution: Image File Execution Options Injection
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Checks whether UAC is enabled
                    • Drops file in System32 directory
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • System policy modification
                    PID:5000
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                      9⤵
                        PID:3524
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                          10⤵
                          • System Location Discovery: System Language Discovery
                          PID:4520
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                        9⤵
                        • System Location Discovery: System Language Discovery
                        PID:2216
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                          10⤵
                            PID:3844
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                          9⤵
                          • System Location Discovery: System Language Discovery
                          PID:968
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                            10⤵
                              PID:808
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                            9⤵
                              PID:1900
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                10⤵
                                  PID:2496
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                9⤵
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                PID:4048
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                  10⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4824
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                9⤵
                                • System Location Discovery: System Language Discovery
                                PID:3888
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of FindShellTrayWindow
                                PID:3916
                              • C:\Windows\SysWOW64\ping.exe
                                ping www.duniasex.com -n 65500 -l 1340
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:1852
                              • C:\Windows\SysWOW64\ping.exe
                                ping www.data0.net -n 65500 -l 1340
                                9⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:4512
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  10⤵
                                    PID:3476
                                • C:\Windows\SysWOW64\ping.exe
                                  ping www.rasasayang.com.my -n 65500 -l 1340
                                  9⤵
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:4988
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                              7⤵
                                PID:4936
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                  8⤵
                                    PID:1664
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                  7⤵
                                    PID:4160
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                    7⤵
                                    • Suspicious use of FindShellTrayWindow
                                    PID:4788
                                  • C:\Windows\SysWOW64\ping.exe
                                    ping www.duniasex.com -n 65500 -l 1340
                                    7⤵
                                    • System Location Discovery: System Language Discovery
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:5148
                                  • C:\Windows\SysWOW64\ping.exe
                                    ping www.data0.net -n 65500 -l 1340
                                    7⤵
                                    • System Location Discovery: System Language Discovery
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:5156
                                  • C:\Windows\SysWOW64\ping.exe
                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                    7⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Runs ping.exe
                                    PID:5164
                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                5⤵
                                  PID:1664
                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:536
                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                  5⤵
                                  • Drops file in System32 directory
                                  PID:3892
                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                    6⤵
                                      PID:4020
                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2932
                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                      6⤵
                                      • Modifies WinLogon for persistence
                                      • Modifies visibility of file extensions in Explorer
                                      • Modifies visiblity of hidden/system files in Explorer
                                      • UAC bypass
                                      • Disables RegEdit via registry modification
                                      • Event Triggered Execution: Image File Execution Options Injection
                                      • Modifies system executable filetype association
                                      • Adds Run key to start application
                                      • Checks whether UAC is enabled
                                      • Drops file in System32 directory
                                      • Modifies Internet Explorer settings
                                      • Modifies registry class
                                      • System policy modification
                                      PID:372
                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                        7⤵
                                          PID:4108
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                            8⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4244
                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                          7⤵
                                            PID:3844
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                              8⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4868
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                            7⤵
                                              PID:636
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3476
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                              7⤵
                                                PID:776
                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                  8⤵
                                                    PID:2868
                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                  7⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4520
                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                    8⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4256
                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                  7⤵
                                                    PID:4616
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                    7⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:3124
                                                  • C:\Windows\SysWOW64\ping.exe
                                                    ping www.duniasex.com -n 65500 -l 1340
                                                    7⤵
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    • Runs ping.exe
                                                    PID:5220
                                                  • C:\Windows\SysWOW64\ping.exe
                                                    ping www.data0.net -n 65500 -l 1340
                                                    7⤵
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    • Runs ping.exe
                                                    PID:5276
                                                  • C:\Windows\SysWOW64\ping.exe
                                                    ping www.rasasayang.com.my -n 65500 -l 1340
                                                    7⤵
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    • Runs ping.exe
                                                    PID:5284
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5228
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                5⤵
                                                • Suspicious use of FindShellTrayWindow
                                                PID:5456
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.duniasex.com -n 65500 -l 1340
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:5568
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.data0.net -n 65500 -l 1340
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:5576
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.rasasayang.com.my -n 65500 -l 1340
                                                5⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:5584
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                            3⤵
                                            • Drops file in System32 directory
                                            PID:908
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                              4⤵
                                                PID:4020
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                              3⤵
                                                PID:4800
                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                  4⤵
                                                  • Modifies WinLogon for persistence
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies visiblity of hidden/system files in Explorer
                                                  • UAC bypass
                                                  • Disables RegEdit via registry modification
                                                  • Event Triggered Execution: Image File Execution Options Injection
                                                  • Modifies system executable filetype association
                                                  • Adds Run key to start application
                                                  • Checks whether UAC is enabled
                                                  • Drops file in System32 directory
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • System policy modification
                                                  PID:1396
                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                    5⤵
                                                      PID:5012
                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                                                        6⤵
                                                          PID:3504
                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3032
                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                                                          6⤵
                                                            PID:4584
                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                                                          5⤵
                                                            PID:4616
                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                                                              6⤵
                                                                PID:1016
                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                              5⤵
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2560
                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                6⤵
                                                                  PID:3528
                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                5⤵
                                                                  PID:4376
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                    6⤵
                                                                      PID:1664
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                    5⤵
                                                                    • Drops file in System32 directory
                                                                    PID:4160
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:552
                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                    5⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    • Runs ping.exe
                                                                    PID:5088
                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                    ping www.data0.net -n 65500 -l 1340
                                                                    5⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    • Runs ping.exe
                                                                    PID:4460
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      6⤵
                                                                        PID:2560
                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                      ping www.rasasayang.com.my -n 65500 -l 1340
                                                                      5⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      • Runs ping.exe
                                                                      PID:3972
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        6⤵
                                                                          PID:4584
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                                                                    3⤵
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3704
                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4788
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                                                                    3⤵
                                                                      PID:4020
                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                                                                        4⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4612
                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3272
                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:4048
                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      • Runs ping.exe
                                                                      PID:776
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        4⤵
                                                                          PID:4868
                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                        ping www.data0.net -n 65500 -l 1340
                                                                        3⤵
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        • Runs ping.exe
                                                                        PID:1956
                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                        ping www.rasasayang.com.my -n 65500 -l 1340
                                                                        3⤵
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        • Runs ping.exe
                                                                        PID:4180

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  2
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Winlogon Helper DLL

                                                                  1
                                                                  T1547.004

                                                                  Event Triggered Execution

                                                                  2
                                                                  T1546

                                                                  Change Default File Association

                                                                  1
                                                                  T1546.001

                                                                  Image File Execution Options Injection

                                                                  1
                                                                  T1546.012

                                                                  Privilege Escalation

                                                                  Abuse Elevation Control Mechanism

                                                                  1
                                                                  T1548

                                                                  Bypass User Account Control

                                                                  1
                                                                  T1548.002

                                                                  Boot or Logon Autostart Execution

                                                                  2
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Winlogon Helper DLL

                                                                  1
                                                                  T1547.004

                                                                  Event Triggered Execution

                                                                  2
                                                                  T1546

                                                                  Change Default File Association

                                                                  1
                                                                  T1546.001

                                                                  Image File Execution Options Injection

                                                                  1
                                                                  T1546.012

                                                                  Defense Evasion

                                                                  Abuse Elevation Control Mechanism

                                                                  1
                                                                  T1548

                                                                  Bypass User Account Control

                                                                  1
                                                                  T1548.002

                                                                  Hide Artifacts

                                                                  2
                                                                  T1564

                                                                  Hidden Files and Directories

                                                                  2
                                                                  T1564.001

                                                                  Impair Defenses

                                                                  1
                                                                  T1562

                                                                  Disable or Modify Tools

                                                                  1
                                                                  T1562.001

                                                                  Modify Registry

                                                                  8
                                                                  T1112

                                                                  Credential Access

                                                                  Discovery

                                                                  Peripheral Device Discovery

                                                                  1
                                                                  T1120

                                                                  Query Registry

                                                                  1
                                                                  T1012

                                                                  Remote System Discovery

                                                                  1
                                                                  T1018

                                                                  System Information Discovery

                                                                  3
                                                                  T1082

                                                                  System Location Discovery

                                                                  1
                                                                  T1614

                                                                  System Language Discovery

                                                                  1
                                                                  T1614.001

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  Internet Connection Discovery

                                                                  1
                                                                  T1016.001

                                                                  Lateral Movement

                                                                  Collection

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Inhibit System Recovery

                                                                  1
                                                                  T1490

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\AppData\Local\Temp\2be1515a460d1a1eed83739c8698af6d_JaffaCakes118.exe 
                                                                    Filesize

                                                                    50KB

                                                                    MD5

                                                                    69beac0954c38e170a6db8c50fe6a055

                                                                    SHA1

                                                                    2b16d43fa9c5d042a030b9267846cf254d47da75

                                                                    SHA256

                                                                    2f850319eb8dcefbd7d7c2f405c9b5a9e76ca7ebda34751017e2f23c01a00e8e

                                                                    SHA512

                                                                    c219d6d014898394116b1b19ac330143396af470198334f01b2944049b5bb9fe2c5febfcb040ff6ed2e75416908b7089ff0261b7c7c2029a60c3cae8a01666a1

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\dvcv.exe
                                                                    Filesize

                                                                    76KB

                                                                    MD5

                                                                    a570aa0fa3e9dcf016095dd9fbf6aa07

                                                                    SHA1

                                                                    23a26b85203167371b550fc2c811e474ab664e73

                                                                    SHA256

                                                                    2727ecd1cecb34f8f2a9e71be4a889ac05a45f60d5d994b4a82083db34cc478d

                                                                    SHA512

                                                                    c8724c425d3228656412bf6a802af145522325a6bb26ab717bb2bb14a6115cfcaab90ee76348ba04eff7ad9071610621930f76ca4e3668b74f707f3cbd8d7e95

                                                                    Download Submit

                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLL
                                                                    Filesize

                                                                    1.4MB

                                                                    MD5

                                                                    25f62c02619174b35851b0e0455b3d94

                                                                    SHA1

                                                                    4e8ee85157f1769f6e3f61c0acbe59072209da71

                                                                    SHA256

                                                                    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

                                                                    SHA512

                                                                    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

                                                                    Download Submit

                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                                                                    Filesize

                                                                    127KB

                                                                    MD5

                                                                    4d279bbc7fbb219243527f16c5067cf0

                                                                    SHA1

                                                                    9bc84abe10d4601da7a9a07d59bde82d43ad8430

                                                                    SHA256

                                                                    e936ecc91f54883345cfba2ba80f6131b37095056e723e123f32eb8ef2681418

                                                                    SHA512

                                                                    6810e681e3ffcfa6b57f46c9d7c408f86422c798e193b4801b60d3b00310b2ae91ab5915ab234a9d089ec4e27ffc1057ee71f40fae6e6efb539e363f786f6a67

                                                                    Download Submit

                                                                  • \??\c:\windows\SysWOW64\Windows 3D.scr
                                                                    Filesize

                                                                    76KB

                                                                    MD5

                                                                    b840b982c9be15e8b60f3879a6bfd69c

                                                                    SHA1

                                                                    30d680770e7632be40c2114b2554383108f8e837

                                                                    SHA256

                                                                    aca9bb9788849e1ed6a76d4dc0b41b6b1e11d8f81e5ad45bb1e295f5c54ee005

                                                                    SHA512

                                                                    91822d38bfbd9325719eada5929dd01bfc0b303ccdea871063eafbfd201ab1d50c343ed489c5b056e415fb62b17c0f9fda32e1cbc906c3c60bc2fa74cf231987

                                                                    Download Submit

                                                                  • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                    Filesize

                                                                    8B

                                                                    MD5

                                                                    24865ca220aa1936cbac0a57685217c5

                                                                    SHA1

                                                                    37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                    SHA256

                                                                    841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                    SHA512

                                                                    c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                    Download Submit

                                                                  • memory/372-495-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/372-593-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/372-610-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/532-373-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/532-395-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/536-390-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/536-445-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/808-484-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1016-474-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1280-297-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1308-355-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1396-558-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1396-491-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1664-523-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1664-592-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1736-231-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1820-161-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1852-265-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1852-419-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/1864-329-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/2028-238-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/2056-377-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/2244-149-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/2496-507-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/2496-518-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/2540-187-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/2640-362-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3372-322-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3396-94-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3476-551-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3504-441-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3528-499-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3568-199-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3744-608-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3744-242-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3844-468-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3960-293-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/3960-307-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4000-368-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4020-404-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4020-408-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4020-472-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4104-348-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4244-520-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4256-597-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4344-302-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4488-275-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4556-386-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4584-452-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4612-572-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4680-336-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4788-560-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4824-211-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4824-537-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4860-282-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4868-541-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4868-246-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4888-268-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4920-227-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4920-615-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4960-221-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4960-606-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4960-7-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/4984-253-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/5000-581-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/5000-423-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download

                                                                  • memory/5072-289-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                    Download